[PATCH net] ixgbe: reserve TX timestamp after skb preparation

[PATCH net] ixgbe: reserve TX timestamp after skb preparation

[Eric Dumazet]

ixgbe_xmit_frame_ring() takes an extra skb reference with skb_get()
for the pending TX timestamp before preparing the skb for transmit.
Several of the following steps may need to reallocate the skb head:

- ixgbe_tso() calls skb_cow_head(), which reaches pskb_expand_head()
  when the header is cloned (e.g. a packet tap holds a clone).
- ixgbe_tx_csum() falls back to skb_checksum_help() for unsupported
  checksum offsets, which can call pskb_expand_head() through
  skb_ensure_writable().
- With DCB and a software VLAN tag, skb_cow_head() is called to
  rewrite the VLAN priority.

pskb_expand_head() used to BUG() on shared skbs. Since commit
c7d8bc3dd511 ("net: skbuff: don't BUG() on bad arguments to
pskb_expand_head()") it returns -EINVAL instead, so these packets
are dropped (TSO, DCB) or sent with an unfinished checksum
(skb_checksum_help() errors are ignored by ixgbe_tx_csum()).

Reserve the TX timestamp right before ixgbe_tx_map(), after all skb
preparation, as i40e and ice already do. The timestamp request
remains covered on the FCoE path, and the cleanup on ixgbe_tx_map()
failure is unchanged.

Fixes: 891dc0821d20 ("ixgbe: Add ptp work item to poll for the Tx timestamp")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 40 +++++++++++--------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index f91856498eb2d9e0e4173153c8c00bc2248bb708..b9496f0bee1312499f28c2f3c24fcff9a1e66e0d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -9444,23 +9444,6 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
 	}
 	protocol = vlan_get_protocol(skb);
 
-	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
-	    adapter->ptp_clock) {
-		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
-		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
-					   &adapter->state)) {
-			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
-			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
-
-			/* schedule check for Tx timestamp */
-			adapter->ptp_tx_skb = skb_get(skb);
-			adapter->ptp_tx_start = jiffies;
-			schedule_work(&adapter->ptp_tx_work);
-		} else {
-			adapter->tx_hwtstamp_skipped++;
-		}
-	}
-
 #ifdef CONFIG_PCI_IOV
 	/*
 	 * Use the l2switch_enable flag - would be false if the DMA
@@ -9525,6 +9508,29 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
 #ifdef IXGBE_FCOE
 xmit_fcoe:
 #endif /* IXGBE_FCOE */
+	/* Reserve the Tx timestamp only after all skb preparation:
+	 * skb_get() makes the skb shared, and pskb_expand_head()
+	 * (reached from skb_cow_head() or skb_checksum_help())
+	 * refuses shared skbs.
+	 */
+	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+	    adapter->ptp_clock) {
+		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
+		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
+					   &adapter->state)) {
+			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+			first->tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+
+			/* schedule check for Tx timestamp */
+			adapter->ptp_tx_skb = skb_get(skb);
+			adapter->ptp_tx_start = jiffies;
+			schedule_work(&adapter->ptp_tx_work);
+		} else {
+			adapter->tx_hwtstamp_skipped++;
+		}
+	}
+
 	if (ixgbe_tx_map(tx_ring, first, hdr_len))
 		goto cleanup_tx_timestamp;
 
-- 
2.53.0

Re: [PATCH net] ixgbe: reserve TX timestamp after skb preparation

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] ixgbe: reserve TX timestamp after skb preparation

[Eric Dumazet]

Le lun. 26 oct. 2026 à 09:26, <netdev-bot+sinfo@kernel.org> a écrit :
>
> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
>

Manual code inspection, coming from Paul Moses discovery for igc (with
a reproducer)

Several Intel drivers share the same defect.
A similar patch for igb is also needed.

>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
>
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Re: [PATCH net] ixgbe: reserve TX timestamp after skb preparation

[Maciej Fijalkowski]

On Mon, Oct 26, 2026 at 09:20:35AM +0100, Eric Dumazet wrote:
> ixgbe_xmit_frame_ring() takes an extra skb reference with skb_get()
> for the pending TX timestamp before preparing the skb for transmit.
> Several of the following steps may need to reallocate the skb head:
> 
> - ixgbe_tso() calls skb_cow_head(), which reaches pskb_expand_head()
>   when the header is cloned (e.g. a packet tap holds a clone).
> - ixgbe_tx_csum() falls back to skb_checksum_help() for unsupported
>   checksum offsets, which can call pskb_expand_head() through
>   skb_ensure_writable().
> - With DCB and a software VLAN tag, skb_cow_head() is called to
>   rewrite the VLAN priority.
> 
> pskb_expand_head() used to BUG() on shared skbs. Since commit
> c7d8bc3dd511 ("net: skbuff: don't BUG() on bad arguments to
> pskb_expand_head()") it returns -EINVAL instead, so these packets
> are dropped (TSO, DCB) or sent with an unfinished checksum
> (skb_checksum_help() errors are ignored by ixgbe_tx_csum()).
> 
> Reserve the TX timestamp right before ixgbe_tx_map(), after all skb
> preparation, as i40e and ice already do. The timestamp request
> remains covered on the FCoE path, and the cleanup on ixgbe_tx_map()
> failure is unchanged.
> 
> Fixes: 891dc0821d20 ("ixgbe: Add ptp work item to poll for the Tx timestamp")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>

> ---
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
> ---
>  drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 40 +++++++++++--------
>  1 file changed, 23 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index f91856498eb2d9e0e4173153c8c00bc2248bb708..b9496f0bee1312499f28c2f3c24fcff9a1e66e0d 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -9444,23 +9444,6 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
>  	}
>  	protocol = vlan_get_protocol(skb);
>  
> -	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
> -	    adapter->ptp_clock) {
> -		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
> -		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
> -					   &adapter->state)) {
> -			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
> -			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
> -
> -			/* schedule check for Tx timestamp */
> -			adapter->ptp_tx_skb = skb_get(skb);
> -			adapter->ptp_tx_start = jiffies;
> -			schedule_work(&adapter->ptp_tx_work);
> -		} else {
> -			adapter->tx_hwtstamp_skipped++;
> -		}
> -	}
> -
>  #ifdef CONFIG_PCI_IOV
>  	/*
>  	 * Use the l2switch_enable flag - would be false if the DMA
> @@ -9525,6 +9508,29 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
>  #ifdef IXGBE_FCOE
>  xmit_fcoe:
>  #endif /* IXGBE_FCOE */
> +	/* Reserve the Tx timestamp only after all skb preparation:
> +	 * skb_get() makes the skb shared, and pskb_expand_head()
> +	 * (reached from skb_cow_head() or skb_checksum_help())
> +	 * refuses shared skbs.
> +	 */
> +	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
> +	    adapter->ptp_clock) {
> +		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
> +		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
> +					   &adapter->state)) {
> +			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
> +			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
> +			first->tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
> +
> +			/* schedule check for Tx timestamp */
> +			adapter->ptp_tx_skb = skb_get(skb);
> +			adapter->ptp_tx_start = jiffies;
> +			schedule_work(&adapter->ptp_tx_work);
> +		} else {
> +			adapter->tx_hwtstamp_skipped++;
> +		}
> +	}
> +
>  	if (ixgbe_tx_map(tx_ring, first, hdr_len))
>  		goto cleanup_tx_timestamp;
>  
> -- 
> 2.53.0
> 
> 

Re: [PATCH net] ixgbe: reserve TX timestamp after skb preparation

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Mon, 26 Oct 2026 09:20:35 +0100 you wrote:
> ixgbe_xmit_frame_ring() takes an extra skb reference with skb_get()
> for the pending TX timestamp before preparing the skb for transmit.
> Several of the following steps may need to reallocate the skb head:
> 
> - ixgbe_tso() calls skb_cow_head(), which reaches pskb_expand_head()
>   when the header is cloned (e.g. a packet tap holds a clone).
> - ixgbe_tx_csum() falls back to skb_checksum_help() for unsupported
>   checksum offsets, which can call pskb_expand_head() through
>   skb_ensure_writable().
> - With DCB and a software VLAN tag, skb_cow_head() is called to
>   rewrite the VLAN priority.
> 
> [...]

Here is the summary with links:
  - [net] ixgbe: reserve TX timestamp after skb preparation
    https://git.kernel.org/netdev/net/c/f75062536e2d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html