3 files changed, 9 insertions, 5 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e89be6282693..eaad23f9c7b5 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1036,7 +1036,11 @@ struct ubuf_info *sock_zerocopy_realloc(struct sock *sk, size_t size,
                         uarg->len++;
                         uarg->bytelen = bytelen;
                         atomic_set(&sk->sk_zckey, ++next);
-                        sock_zerocopy_get(uarg);
+
+                        /* no extra ref when appending to datagram (MSG_MORE) */
+                        if (sk->sk_type == SOCK_STREAM)
+                                sock_zerocopy_get(uarg);
+
                         return uarg;
                 }
         }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index bfd0ca554977..8c9189a41b13 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -878,7 +878,7 @@ static int __ip_append_data(struct sock *sk,
         int csummode = CHECKSUM_NONE;
         struct rtable *rt = (struct rtable *)cork->dst;
         unsigned int wmem_alloc_delta = 0;
-        bool paged, extra_uref;
+        bool paged, extra_uref = false;
         u32 tskey = 0;
 
         skb = skb_peek_tail(queue);
@@ -918,7 +918,7 @@ static int __ip_append_data(struct sock *sk,
                 uarg = sock_zerocopy_realloc(sk, length, skb_zcopy(skb));
                 if (!uarg)
                         return -ENOBUFS;
-                extra_uref = true;
+                extra_uref = !skb;      /* only extra ref if !MSG_MORE */
                 if (rt->dst.dev->features & NETIF_F_SG &&
                     csummode == CHECKSUM_PARTIAL) {
                         paged = true;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index adef2236abe2..f9e43323e667 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1275,7 +1275,7 @@ static int __ip6_append_data(struct sock *sk,
         int csummode = CHECKSUM_NONE;
         unsigned int maxnonfragsize, headersize;
         unsigned int wmem_alloc_delta = 0;
-        bool paged, extra_uref;
+        bool paged, extra_uref = false;
 
         skb = skb_peek_tail(queue);
         if (!skb) {
@@ -1344,7 +1344,7 @@ emsgsize:
                 uarg = sock_zerocopy_realloc(sk, length, skb_zcopy(skb));
                 if (!uarg)
                         return -ENOBUFS;
-                extra_uref = true;
+                extra_uref = !skb;      /* only extra ref if !MSG_MORE */
                 if (rt->dst.dev->features & NETIF_F_SG &&
                     csummode == CHECKSUM_PARTIAL) {
                         paged = true;