Re: [PATCH RFC net-next 5/9] net-timestamp: use pskb_copy to avoid polluting the orig skb's start time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: missing tx_flags and tskey initialization after pskb_copy()
--

commit 25f6ea681d5fbb36cc3d7e6a5d0bca7daa16f7a1
Author: Jason Xing <kerneljasonxing@gmail.com>

net-timestamp: use pskb_copy to avoid polluting the orig skb's start time

This commit changes the behavior of __skb_tstamp_tx() when both net
timestamping and BPF timestamping v2 are enabled. It uses pskb_copy()
instead of skb_clone() to create the error-queue skb, ensuring it gets a
separate skb_shared_info block to prevent hardware TX timestamp writes from
clobbering start_time.

> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index dbbe10277d51d..a38c98554ff82 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -5749,7 +5749,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
[ ... ]
>  			skb = alloc_skb(0, GFP_ATOMIC);
>  	} else {
> -		skb = skb_clone(orig_skb, GFP_ATOMIC);
> +		if (static_branch_unlikely(&bpfts_v2_needed_key) && hwtstamps)
> +			skb = pskb_copy(orig_skb, GFP_ATOMIC);
> +		else
> +			skb = skb_clone(orig_skb, GFP_ATOMIC);

[Severity: High]
Will this leave tx_flags and tskey uninitialized when the pskb_copy() path
is taken?

Unlike skb_clone(), pskb_copy() creates a new zero-initialized
skb_shared_info block, omitting the copying of metadata like tskey and
tx_flags.

Later in __skb_tstamp_tx(), the explicit copying of these fields is bypassed
because the pskb_copy() fallback path means tsonly is false:

        if (tsonly) {
                skb_shinfo(skb)->tx_flags |= skb_shinfo(orig_skb)->tx_flags &
                                             SKBTX_ANY_TSTAMP;
                skb_shinfo(skb)->tskey = skb_shinfo(orig_skb)->tskey;
        }

Because these fields remain zero on the newly copied SKB, will this break
the SOF_TIMESTAMPING_OPT_ID socket option functionality by reporting an
invalid or zero timestamp ID (ee_data) to userspace when a hardware
timestamp is generated?

>  		if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) {
>  			kfree_skb(skb);
>  			return;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919143732.11772-1-kerneljasonxing@gmail.com?part=5