[PATCH] af_unix: mark MSG_SPLICE_PAGES frags shared

[PATCH] af_unix: mark MSG_SPLICE_PAGES frags shared

[Yiming Qian]

unix_stream_sendmsg() splices external pages directly into skb frags when
MSG_SPLICE_PAGES is set, but it does not propagate SKBFL_SHARED_FRAG
afterward.

That leaves later writers without the shared-frag marker even though the
skb still references externally owned pages.

Set the marker after a successful skb_splice_from_iter() call.

Fixes: a0dbf5f818f90 ("af_unix: Support MSG_SPLICE_PAGES")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reported-by: Can Liu <lingchen5202005@gmail.com>
Signed-off-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Can Liu <lingchen5202005@gmail.com>
---
 net/unix/af_unix.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f7a9d55eee8a1..f2cd0f8ec0914 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2458,6 +2458,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
 				goto out_free;
 
 			size = err;
+			skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
 			refcount_add(size, &sk->sk_wmem_alloc);
 		} else {
 			skb_put(skb, size - data_len);
-- 
2.34.1

Re: [PATCH] af_unix: mark MSG_SPLICE_PAGES frags shared

[Kuniyuki Iwashima]

On Tue, Jun 30, 2026 at 12:06 AM Yiming Qian <yimingqian591@gmail.com> wrote:
>
> unix_stream_sendmsg() splices external pages directly into skb frags when
> MSG_SPLICE_PAGES is set, but it does not propagate SKBFL_SHARED_FRAG
> afterward.

I think it doesn't matter with the plain AF_UNIX.

Please elaborate on the scenario where this could be a problem.
e.g. sockmap ?


>
> That leaves later writers without the shared-frag marker even though the
> skb still references externally owned pages.
>
> Set the marker after a successful skb_splice_from_iter() call.
>
> Fixes: a0dbf5f818f90 ("af_unix: Support MSG_SPLICE_PAGES")
> Reported-by: Yiming Qian <yimingqian591@gmail.com>
> Reported-by: Can Liu <lingchen5202005@gmail.com>

Reported-by is not needed when it's identical to SOB tag.


> Signed-off-by: Yiming Qian <yimingqian591@gmail.com>
> Signed-off-by: Can Liu <lingchen5202005@gmail.com>
> ---
>  net/unix/af_unix.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index f7a9d55eee8a1..f2cd0f8ec0914 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -2458,6 +2458,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
>                                 goto out_free;
>
>                         size = err;
> +                       skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
>                         refcount_add(size, &sk->sk_wmem_alloc);
>                 } else {
>                         skb_put(skb, size - data_len);
> --
> 2.34.1