Re: [PATCH net-next v4] skb_expand_head() adjust skb->truesize incorrectly

[Eric Dumazet]

On 9/1/21 9:32 PM, Eric Dumazet wrote:

> 
> I think you missed netem case, in particular
> skb_orphan_partial() which I already pointed out.
> 
> You can setup a stack of virtual devices (tunnels),
> with a qdisc on them, before ip6_xmit() is finally called...
> 
> Socket might have been closed already.
> 
> To test your patch, you could force a skb_orphan_partial() at the beginning
> of skb_expand_head() (extending code coverage)
> 

To clarify :

It is ok to 'downgrade' an skb->destructor having a ref on sk->sk_wmem_alloc to
something owning a ref on sk->refcnt.

But the opposite operation (ref on sk->sk_refcnt -->  ref on sk->sk_wmem_alloc) is not safe.