Re: [PATCH net] amt: do not store tunnel pointer in skb control block

[Cen Zhang (Microsoft Security FORGE Labs)]

On Wed, Aug 26, 2026 at 09:56:35PM +0900, Taehee Yoo wrote:
> How about protecting amt_tunnel_list with a refcount?
> Currently amt_tunnel_expire() frees the tunnel immediately, but with a
> refcount we could just drop the reference there and let the memory be
> freed once it reaches 0.
>
> What do you think?

Sorry for the late reply, I was busy with something else and am back
on this now.

I checked this for a while and I believe we cannot keep a refcount
balanced from skb->cb: once the skb enters the qdisc/tc layer it can
be dropped, cloned or orphaned before it reaches amt_dev_xmit(),
depending on the user's qdisc/tc commands. So a put inside
amt_dev_xmit() cannot be balanced against the get taken before
queueing, and the tunnel would either leak or be freed early.

I will send a v2 with the comment removed, from my corporate address
cenzhang@xxxxxxxxxxxxxxxxxxx.

Thanks,
Cen