Re: [PATCH] af_unix: mark MSG_SPLICE_PAGES frags shared

[钱一铭]

Thanks, I agree plain AF_UNIX does not by itself provide the writer side.

  The concern was that MSG_SPLICE_PAGES imports externally owned pages into
  skb frags, while unlike TCP/UDP/KCM this path does not mark them with
  SKBFL_SHARED_FRAG. I checked the AF_UNIX sockmap path as well, but I do
  not currently have a concrete in-tree chain where those frags reach a
  writer that skips COW based on skb_has_shared_frag().

  So this should be treated as a defensive consistency cleanup rather than
  a security fix. I will drop the Fixes tag and the duplicate Reported-by
  tags in v2.

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> 于2026年6月30日周二 23:51写道：
>
> On Tue, Jun 30, 2026 at 12:06 AM Yiming Qian <yimingqian591@xxxxxxxxx> wrote:
> >
> > unix_stream_sendmsg() splices external pages directly into skb frags when
> > MSG_SPLICE_PAGES is set, but it does not propagate SKBFL_SHARED_FRAG
> > afterward.
>
> I think it doesn't matter with the plain AF_UNIX.
>
> Please elaborate on the scenario where this could be a problem.
> e.g. sockmap ?
>
>
> >
> > That leaves later writers without the shared-frag marker even though the
> > skb still references externally owned pages.
> >
> > Set the marker after a successful skb_splice_from_iter() call.
> >
> > Fixes: a0dbf5f818f90 ("af_unix: Support MSG_SPLICE_PAGES")
> > Reported-by: Yiming Qian <yimingqian591@xxxxxxxxx>
> > Reported-by: Can Liu <lingchen5202005@xxxxxxxxx>
>
> Reported-by is not needed when it's identical to SOB tag.
>
>
> > Signed-off-by: Yiming Qian <yimingqian591@xxxxxxxxx>
> > Signed-off-by: Can Liu <lingchen5202005@xxxxxxxxx>
> > ---
> >  net/unix/af_unix.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> > index f7a9d55eee8a1..f2cd0f8ec0914 100644
> > --- a/net/unix/af_unix.c
> > +++ b/net/unix/af_unix.c
> > @@ -2458,6 +2458,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
> >                                 goto out_free;
> >
> >                         size = err;
> > +                       skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
> >                         refcount_add(size, &sk->sk_wmem_alloc);
> >                 } else {
> >                         skb_put(skb, size - data_len);
> > --
> > 2.34.1