Re: [PATCH v3 9/9] RFC: net: limit folio refcount when splicing from sockets

[Pedro Falcato]

On Tue, Nov 10, 2026 at 09:35:49PM +0100, David Hildenbrand (Arm) wrote:
> Various networking features support splicing data from sockets into
> pipes (TCP, AF_UNIX, KCM, kTLS), whereby spd_fill_page() takes an
> additional page reference for each fragment, while the skb keeps its own
> reference until it was fully consumed. This allows for exceeding folio
> refcount limits.
> 
> This is not specific to large pagecache folios, but with them it is a
> lot easier to reach the refcount limit, as page table mappings can cheaply
> create many references.
> 
> Let's use try_get_page() in spd_fill_page() and stop splicing with
> -EFAULT if that fails. To propagate the error, let spd_fill_page(),
> __splice_segment() and __skb_splice_bits() return an int instead of a
> bool. If we could not splice anything, return the error from
> skb_splice_bits(): returning 0 would make the callers (TCP, AF_UNIX, KCM,
> kTLS) report EOF, although data is still queued. The callers already
> handle errors.
> 
> Use -EFAULT, consistent with splice_folio_into_pipe().
> 
> Fixes: 800d8c63b2e9 ("shmem: add huge pages support")
> Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
> Fixes: 793917d997df ("mm/readahead: Add large folio readahead")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

Acked-by: Pedro Falcato <pfalcato@xxxxxxx> 

-- 
Pedro