From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4542731716C for ; Thu, 28 May 2026 18:32:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779993146; cv=none; b=nJNYxQzPXC324/mYcZF4UDAn4VFuL3QV9ehf/LFJsS6k3SR0uFLgY2plNF62o56TMRq14WubbjksUC5bXdOdFF/AxbW9m7MOd8/xgKHM/JjRV0kjMISofZ5rsYeoiFSAss9QZMD6YpAczdSO3VoMyukiTsYskFxeM9aNCVqmZoo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779993146; c=relaxed/simple; bh=F6dv8TPWW/13dGP+ZBJhBGuAWttYv01S6yZqJ9bd55Q=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=L1aRUIIGjNE3yq5XPEvJHGGl2W9HqT5sk5A8QhAG9q+YU6w0FUfpDjY0HGdnEQdpbl+1yvmqLUbE9NocRPv8XhgbXTbYySrwYJjYJhP0k+AqRo6lRVbNO7YFniSmJLtAaqseqozShwtyng5NI3XHN9dl0laUGLn0LXriyRY3ihI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RhRq8O0d; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RhRq8O0d" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4904c1ce4c1so70423235e9.3 for ; Thu, 28 May 2026 11:32:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779993143; x=1780597943; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=YgIc6FFWhSDaSLL/Z7NgL4wbq54EDyvmvF+ou2yO3wM=; b=RhRq8O0d+RlqfQgi2bF8cVzCvpgalFUFq/BidvQine5M96J7A+pLHzGlscGcY2bOM8 Bo4LOgxw3NYi9k/8Z0mqLkkVjg+hJ3KfxTOKRJ6+wZVfshKZmYYd7RCSJN//IO30I1jU j0OM0gF6sGQQUzdhxTg+/sN9wg0TUW7VbRv0LnYkx2CscweQrHzDMXajHVrhcNg4/+Yt BIpAqBm/rxdT8SC2tgv46A6Y4CnbhpFXlsvcd33wVHz+Z5LGFZoCfIUeU/tsGv91b+yK tAE9HsB16EwQfKNKbFKhM4gRnPBiwmZVuah6ztKaMre0Q31ymt3T2hcn35oA5Bo2MG87 GWTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779993143; x=1780597943; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=YgIc6FFWhSDaSLL/Z7NgL4wbq54EDyvmvF+ou2yO3wM=; b=cuVjdsvGWHHpRpPJLiIW+twF0YJgkGCjHhUOI8lUhW3b/eg5oNpgtr3Ks4dcRreOHu bokQMapvCBwFE8zhFn27bu7amZQIjm/WUAgClLA+6KtqZT3/SmOg1aFDxUpFucSpLtzg +UR7dE7j31OP8Th9+9aaJAtZ7eG2HPuUdixo6hyMShd+WPRhXWLjKYPlSTGLimgK6KH/ 0Coac3YUUkmQ+0HDdBNI2fsXF15fH7OcpXkxPCRN2dx1321z/JB7bvfkMIDEVJQHZHH5 /w85avuMBojbDUDfz8heGfLHMKC9xPZkOtq8UXyppdjoDll899HjKs1HUFmeMl6kaxLJ /77g== X-Forwarded-Encrypted: i=1; AFNElJ9OThOlbppNXt+5waCb/j+auERxAbBA1Gmpm7Bk97zTEZajeMtnaks9uEpNsJuUBl5/BykwIz5UnQwOPG8=@vger.kernel.org X-Gm-Message-State: AOJu0YxCogxHRN/Hqm7apqiGSq5qai60TrJjFQ4CTn4T352W8eORcVit E0tLWwV2nsj9w3EFKm4Nb70w8G0qoJc4QL6x7oTyCrUIEs28b2xXrmMm X-Gm-Gg: Acq92OGiNXDrKVFpphYDbm09ivD5kR/i+HlRghLrHxuh6QhFpJfentRkRDRBN0pqIwh IgwJMVUCGk7HTxv1M2IFvv1BNKTbSZ1tStIh9tPgAkPCYlxdq+s5pHC76cOr0vdcpjCfkQApB3C 4J1X1Xc1fPwcxzkCucSEDKnuwTf1nyBKu1UiidQYFqP9tOctmZ8BzGqynQoRMYjkW7dcLqrQp53 fw6kPW3dFOLaSyv/WYyI1g1t8H67lli78QbbIrm1hsbzwqzxfQ372cfp9jsfAdUlObnrZP4AigY qs9r37nspxaKTWwf4o91WdiqsBX3to4xfxbR6zz5rWIO9XT/yku/KG804MrvhUu66lF4cITnXZg nXJngnvWCFOfCtFB/YEy9iXGXcjFA6rX1IVSZQthe2dNAt7Pt1A48bmQ09adWOScrIHHZObcNfo Ek+GtSGlaGMEF3FrR4NKPW+lqb/CVg/ceWrDI5MFC4wvy/rBsNWtRG9nTs7eMlyhNj/V9ipEtDZ YLAekEdd2MV93rRcU3XRzYim1YqF7jnful72tbRjPjwlZ01qfW2wx8Hed3ZyCZubCU6dasIPmMu D5qdhYlEljXK X-Received: by 2002:a05:600c:c83:b0:48f:d612:3c4a with SMTP id 5b1f17b1804b1-49042488b81mr468589175e9.1.1779993143226; Thu, 28 May 2026 11:32:23 -0700 (PDT) Received: from ?IPV6:2a01:4b00:bd21:4f00:7cc6:d3ca:494:116c? ([2a01:4b00:bd21:4f00:7cc6:d3ca:494:116c]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4909235d4e5sm78490035e9.2.2026.05.28.11.32.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 28 May 2026 11:32:22 -0700 (PDT) Message-ID: <5f63fd24-a0da-4623-b449-1e749c3e2085@gmail.com> Date: Thu, 28 May 2026 19:32:19 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net v2] net: skbuff: fix missing zerocopy reference in pskb_carve helpers To: lazyming , netdev@vger.kernel.org Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, sowmini.varadhan@oracle.com, willemdebruijn.kernel@gmail.com, w@1wt.eu, linux-kernel@vger.kernel.org, stable@vger.kernel.org, achender@kernel.org, mst@redhat.com, jasowang@redhat.com, Willem de Bruijn References: <20260526041240.329462-1-minhnguyen.080505@gmail.com> Content-Language: en-US From: Pavel Begunkov In-Reply-To: <20260526041240.329462-1-minhnguyen.080505@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 5/26/26 05:12, lazyming wrote: > From: Minh Nguyen > > pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy > the old skb_shared_info header into a new buffer via memcpy(), which > includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. > Neither function calls net_zcopy_get() for the new shinfo, creating an > unaccounted holder: every skb_shared_info with destructor_arg set will > call skb_zcopy_clear() once when freed, but the corresponding > net_zcopy_get() was never called for the new copy. Repeated calls > drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while > TX skbs still hold live destructor_arg pointers. A bit late but lgtm Reviewed-by: Pavel Begunkov -- Pavel Begunkov