1 files changed, 8 insertions, 3 deletions

diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index 9923e9e3b884..c3fe3f3a78f5 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -129,12 +129,17 @@ static void iscsi_tcp_segment_map(struct iscsi_segment *segment, int recv)
         BUG_ON(sg->length == 0);
 
         /*
+         * We always map for the recv path.
+         *
          * If the page count is greater than one it is ok to send
          * to the network layer's zero copy send path. If not we
-         * have to go the slow sendmsg path. We always map for the
-         * recv path.
+         * have to go the slow sendmsg path.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
          */
-        if (page_count(sg_page(sg)) >= 1 && !recv)
+        if (!recv && page_count(sg_page(sg)) >= 1 && !PageSlab(sg_page(sg)))
                 return;
 
         if (recv) {