Re: [PATCH net v2] net: skbuff: fix missing zerocopy reference in pskb_carve helpers

[Pavel Begunkov]

On 5/26/26 05:12, lazyming wrote:
> From: Minh Nguyen <minhnguyen.080505@xxxxxxxxx>
>
> pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy
> the old skb_shared_info header into a new buffer via memcpy(), which
> includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.
> Neither function calls net_zcopy_get() for the new shinfo, creating an
> unaccounted holder: every skb_shared_info with destructor_arg set will
> call skb_zcopy_clear() once when freed, but the corresponding
> net_zcopy_get() was never called for the new copy. Repeated calls
> drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while
> TX skbs still hold live destructor_arg pointers.

A bit late but lgtm

Reviewed-by: Pavel Begunkov <asml.silence@xxxxxxxxx>

--
Pavel Begunkov