Re: [PATCH net-next v3 4/6] net: skbuff: replace __skb_frag_ref() with symmetric skb_netmem_ref()

[Antony Antony]

On Wed, Oct 14, 2026 at 17:37:18 +0000, Mina Almasry wrote:
> Previously, __skb_frag_ref() and skb_frag_ref() unconditionally
> incremented the non-pp backing refcount via get_netmem(), while
> skb_frag_unref() decremented pp_ref_count whenever skb->pp_recycle was
> set. Ref-ing a page_pool fragment into a pp_recycle=1 SKB (or clearing
> pp_recycle=0 on an uncloned SKB while clones still held pp_recycle=1)
> leaked the backing non-pp refcount and underflowed pp_ref_count across
> IP-TFS, skb_split(), skb_shift(), and cloned unclone paths.
> 
> Replace __skb_frag_ref() with skb_netmem_ref(netmem, recycle) as the
> exact counterpart to skb_netmem_unref(netmem, recycle):
> 
> - Keep skb->pp_recycle intact in skb_release_data() so uncloning paths
>   (pskb_expand_head() and pskb_carve_inside_{header,nonlinear}()) keep
>   trading pp_ref_count references symmetrically across clones.
> - Propagate pp_recycle and call skb_frag_ref() on the destination SKB in
>   __pskb_copy_fclone(), skb_zerocopy(), skb_split(), skb_shift(), and
>   skb_segment().
> - Linearize an output segment's existing frags in skb_segment() before
>   attaching frags from a frag_list SKB with a different pp_recycle bit,
>   since each output segment carries a single pp_recycle bit.
> - Use skb_frag_ref() in xfrm_iptfs, chcr_ktls, and cassini, and call
>   get_netmem() directly in veth and tls_device_fallback where callers
>   explicitly take a raw non-pp reference.
> 
> Found by code inspection while reviewing the IP-TFS pp_ref_count fix [1]
> and confirmed with the KUnit tests added later in this series; not
> observed in production. The xfrm_iptfs, chcr_ktls, cassini, veth, and
> tls_device_fallback changes are compile-tested only.
> 
> Link: https://lore.kernel.org/netdev/xfrm-iptfs-pp_ref_count-underflow-v4-1-912fa72106f0@xxxxxxxxxxx/ [1]
> Cc: Antony Antony <antony.antony@xxxxxxxxxxx>
> Cc: Stanislav Fomichev <sdf@xxxxxxxxxxx>
> Cc: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
> Cc: Alexei Starovoitov <ast@xxxxxxxxxx>
> Cc: Jesper Dangaard Brouer <hawk@xxxxxxxxxx>
> Cc: bpf@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Mina Almasry <almasrymina@xxxxxxxxxx>

Tested-by: Antony Antony <antony.antony@xxxxxxxxxxx>

I tested for IP-TFS virtio. 

Steffen, if this patch is applied, the following will become redundant:
https://patchwork.kernel.org/project/netdevbpf/patch/xfrm-iptfs-pp_ref_count-underflow-v5-1-c25508ec9160@xxxxxxxxxxx/
-antony