[BUG] net/sched: skb leak with HTB + fq_codel on packet drops

[Damilola Bello]

Description:

Using fq_codel as a child qdisc under HTB results in continuous growth
of skbuff_head_cache objects when packet drops occur. Memory is not
freed even after traffic stops, and the system can eventually run out
of memory.

Regression:

- Works on: 6.18.16

- Fails on: 6.19.x (tested on 6.19.10-200.fc43)

Environment:

- Kernel: 6.19.10-200.fc43

- Distro: Fedora 43

- NICs: ens2f0np0, ens2f1np1

- GRO/GSO/TSO: disabled

Reproduction:

#!/bin/sh
DEVS="ens2f0np0 ens2f1np1"
for DEV in $DEVS; do
tc qdisc del dev $DEV root 2>/dev/null
tc qdisc add dev $DEV root handle 1: htb default 10
tc class add dev $DEV parent 1: classid 1:10 htb rate 100mbit
tc qdisc add dev $DEV parent 1:10 handle 10: fq_codel
tc filter add dev $DEV parent 1: matchall flowid 1:10
done

Generate traffic exceeding 100mbit (e.g., iperf3) to force drops.

Observed behavior:

- fq_codel reports packet drops

- skbuff_head_cache grows continuously:

- grep skbuff_head_cache /proc/slabinfo
  skbuff_head_cache 12144512 ... (continues increasing)

- skbuff_head_cache doesn't clear off even after traffic stops.

Key observations:

- Leak only occurs when fq_codel drops packets

- No drops -> no leak

- HTB + pfifo -> no leak

- fq_codel as root qdisc -> no leak

- cake as root qdisc -> no leak

- The leak only occurs when fq_codel (or cake) is used as a child
qdisc under HTB

Expected behavior:

- SKBs should be freed after drops

- skbuff_head_cache should stabilize after traffic stops

Additional notes:

- This appears related to skb lifetime/accounting during drop handling
in the HTB + child qdisc path

- Possibly related to GRO/GSO interaction or skb segmentation handling

Request:

- Is this a known regression?

- Any guidance on further debugging or identifying the offending commit?