unix_stream_sendmsg() splices external pages directly into skb frags when MSG_SPLICE_PAGES is set, but it does not propagate SKBFL_SHARED_FRAG afterward. That leaves later writers without the shared-frag marker even though the skb still references externally owned pages. Set the marker after a successful skb_splice_from_iter() call. Fixes: a0dbf5f818f90 ("af_unix: Support MSG_SPLICE_PAGES") Reported-by: Yiming Qian Reported-by: Can Liu Signed-off-by: Yiming Qian Signed-off-by: Can Liu --- net/unix/af_unix.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index f7a9d55eee8a1..f2cd0f8ec0914 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2458,6 +2458,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, goto out_free; size = err; + skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; refcount_add(size, &sk->sk_wmem_alloc); } else { skb_put(skb, size - data_len); -- 2.34.1