2 files changed, 2 insertions, 10 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 246ca1c81715..a003f953a0a6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -963,7 +963,7 @@ struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size)
         uarg->len = 1;
         uarg->bytelen = size;
         uarg->zerocopy = 1;
-        atomic_set(&uarg->refcnt, 0);
+        atomic_set(&uarg->refcnt, 1);
         sock_hold(sk);
 
         return uarg;
@@ -1005,6 +1005,7 @@ struct ubuf_info *sock_zerocopy_realloc(struct sock *sk, size_t size,
                         uarg->len++;
                         uarg->bytelen = bytelen;
                         atomic_set(&sk->sk_zckey, ++next);
+                        sock_zerocopy_get(uarg);
                         return uarg;
                 }
         }
@@ -1102,13 +1103,6 @@ void sock_zerocopy_put_abort(struct ubuf_info *uarg)
                 atomic_dec(&sk->sk_zckey);
                 uarg->len--;
 
-                /* sock_zerocopy_put expects a ref. Most sockets take one per
-                 * skb, which is zero on abort. tcp_sendmsg holds one extra, to
-                 * avoid an skb send inside the main loop triggering uarg free.
-                 */
-                if (sk->sk_type != SOCK_STREAM)
-                        atomic_inc(&uarg->refcnt);
-
                 sock_zerocopy_put(uarg);
         }
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7a3d84375836..5091402720ab 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1190,8 +1190,6 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
                         goto out_err;
                 }
 
-                /* skb may be freed in main loop, keep extra ref on uarg */
-                sock_zerocopy_get(uarg);
                 if (!(sk_check_csum_caps(sk) && sk->sk_route_caps & NETIF_F_SG))
                         uarg->zerocopy = 0;
         }