1 files changed, 9 insertions, 3 deletions

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 57fcc6b4bf6e..2f126eff275d 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -580,9 +580,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
         struct bio_vec bvec;
         int ret;
 
-        /* sendpage cannot properly handle pages with page_count == 0,
-         * we need to fallback to sendmsg if that's the case */
-        if (page_count(page) >= 1)
+        /*
+         * sendpage cannot properly handle pages with page_count == 0,
+         * we need to fall back to sendmsg if that's the case.
+         *
+         * Same goes for slab pages: skb_can_coalesce() allows
+         * coalescing neighboring slab objects into a single frag which
+         * triggers one of hardened usercopy checks.
+         */
+        if (page_count(page) >= 1 && !PageSlab(page))
                 return __ceph_tcp_sendpage(sock, page, offset, size, more);
 
         bvec.bv_page = page;