Re: [PATCH net v2] amt: do not store tunnel pointer in skb control block

[Cen Zhang (Microsoft Security FORGE Labs)]

Hi Omar,

On Thu, Sep 24, 2026 at 01:56:31AM +0300, Omar Ramadan wrote:
> Agreed on the refcount. Could we avoid both the refcount and the
> lookup by not sending the relay's GQ through amt_dev_xmit() at all?

Thanks for the exploration and the thoughtful solution. I did not
consider removing the round trip in the first place, since that
looked like a user-visible behaviour change, but your write-up
covers it well.

> I haven't reproduced the KASAN report. Could you share the netem
> setup you used, so I can run it before and after?

I will send you and Taehee the reproducer artifact in private soon.
It covers the base, base + your diff and base + v2.

> If you and Taehee like this direction, either of these works for me:
>  - I post it as v3 with your KASAN trace in the commit message,
>    keeping the existing Reported-by tags (you're already one), plus
>    Co-developed-by if you'd like; that needs your Signed-off-by.

If Taehee is fine with it, let's go with your v3. I am fine with the
credit as long as the CVE credits the report to Xiang and I (so for
my institution).

Thanks,
Cen