[RFC PATCH net-next 1/4] net: preserve splice iterator progress on rejection

From: Alex Markuze

Date: Tue Nov 10 2026 - 06:26:50 EST


When the iterator is nonempty and the maximum length is zero, the generic
extraction path reports -EIO instead of performing a no-op. Return zero
before attempting extraction.

The extractor advances the iterator before checking whether the pages can
be sent. If a page is rejected, revert the unappended extraction
remainder, as the fragment-append failure path already does. This keeps
an accepted prefix and leaves the rejected suffix available to the caller.

Fixes: 2e910b95329c ("net: Add a function to splice pages into an skbuff for MSG_SPLICE_PAGES")
Signed-off-by: Alex Markuze <amarkuze@xxxxxxxxxx>
---
net/core/skbuff.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 48f676411724..ee7a1bc72cc2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -7554,6 +7554,9 @@ ssize_t skb_splice_from_iter(struct sk_buff *skb, struct iov_iter *iter,
ssize_t spliced = 0, ret = 0;
unsigned int i;

+ if (!maxsize)
+ return 0;
+
while (iter->count > 0) {
ssize_t space, nr, len;
size_t off;
@@ -7578,8 +7581,10 @@ ssize_t skb_splice_from_iter(struct sk_buff *skb, struct iov_iter *iter,
size_t part = min_t(size_t, PAGE_SIZE - off, len);

ret = -EIO;
- if (WARN_ON_ONCE(!sendpage_ok(page)))
+ if (WARN_ON_ONCE(!sendpage_ok(page))) {
+ iov_iter_revert(iter, len);
goto out;
+ }

ret = skb_append_pagefrags(skb, page, off, part,
frag_limit);

base-commit: 4dd16e31135ea8437a720222df34e8745f385d6d
--
2.34.1