netdev - Re: skb_attempt_defer_free and reference counting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJQ_Hx_T7N6LPr2Qt-_O2KZ3GPgWFtywJBvjjTQvGwy2Q@mail.gmail.com>
Date: Fri, 31 Oct 2025 04:43:19 -0700
From: Eric Dumazet <edumazet@...gle.com>
To: "Hudson, Nick" <nhudson@...mai.com>
Cc: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: skb_attempt_defer_free and reference counting

On Fri, Oct 31, 2025 at 4:04 AM Hudson, Nick <nhudson@...mai.com> wrote:
>
> Hi,
>
> I’ve been looking at using skb_attempt_defer_free and had a question about the skb reference counting.
>
> The existing reference release for any skb handed to skb_attempt_defer_free is done in skb_defer_free_flush (via napi_consume_skb). However, it seems to me that calling skb_attempt_defer_free on the same skb to drop the multiple references is problematic as, if the defer_list isn’t serviced between the calls, the list gets corrupted. That is, the skb can’t appear on the list twice.
>
> Would it be possible to move the reference count drop into skb_attempt_defer_free and only add the skb to the list on last reference drop?

We do not plan using this helper for arbitrary skbs, but ones fully
owned by TCP and UDP receive paths.

skb_share_check() must have been called before reaching them.

In any case using skb->next could be problematic with shared skb.