[PATCH net v3 1/1] rxrpc: fix encap_rcv skb accounting exhaustion

[zihan xi]

On Tue, Sep 8, 2026 at 4:25 PM David Howells <dhowells at redhat.com> wrote:
>
> Zihan Xi <zihanx at nebusec.ai> wrote:
>
> > Reaccount encapsulated packets against the UDP socket before queueing
> > them on the RxRPC local queue and drop packets once the socket rcvbuf
> > limit is reached.
>
> This seems reasonable.  I do really need to add separate accounting for
> buffered incoming DATA packets and for all other incoming packets (especially
> ACKs), but I think that can be done after the skb_orphan() point you add.

Yes.  Once the skb is orphaned, that split can sit after that point
without the UDP rmem charge following the packet onto call/conn queues.
>
> > Clear sk_user_data under RCU protection and release the socket only after
> > the local queues are purged.
>
> Is this actually a fix for a separate issue?

No - it's required by the skb_set_owner_r() change itself.

skb_set_owner_r() sets the destructor to sock_rfree() and does not take
a ref on the UDP socket.  The old rxrpc_destroy_local() released the
socket before purging the local queues, which would be unsafe once those
skbs are charged to the socket.  rcu_assign_sk_user_data() plus
synchronize_rcu() is only there so a concurrent encap_rcv() cannot
attach more socket-owned skbs after teardown has started; sock_release()
then waits until those queues have been purged.
>
> Anyway:
>
> Acked-by: David Howells <dhowells at redhat.com>
>
Thanks for the ack.

Best regards,
Zihan Xi