Re: [PATCH net 12/12] netfilter: nf_queue: hold bridge skb->dev while queued

[Jakub Kicinski <kuba@kernel.org>]

On Sat, 16 May 2026 13:56:27 +0200 Pablo Neira Ayuso wrote:
> diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
> index d17035d14d96..3978c3174cdb 100644
> --- a/include/net/netfilter/nf_queue.h
> +++ b/include/net/netfilter/nf_queue.h
> @@ -14,6 +14,7 @@ struct nf_queue_entry {
>  	struct list_head	list;
>  	struct rhash_head	hash_node;
>  	struct sk_buff		*skb;
> +	struct net_device	*skb_dev;
>  	unsigned int		id;
>  	unsigned int		hook_index;	/* index in hook_entries->hook[] */
>  #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
> diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
> index a6c81c04b3a5..57b450024a99 100644
> --- a/net/netfilter/nf_queue.c
> +++ b/net/netfilter/nf_queue.c
> @@ -61,6 +61,7 @@ static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
>  	struct nf_hook_state *state = &entry->state;
>  
>  	/* Release those devices we held, or Alexey will kill me. */
> +	dev_put(entry->skb_dev);
>  	dev_put(state->in);
>  	dev_put(state->out);
>  	if (state->sk)
> @@ -102,6 +103,7 @@ bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
>  	if (state->sk && !refcount_inc_not_zero(&state->sk->sk_refcnt))
>  		return false;
>  
> +	dev_hold(entry->skb_dev);
>  	dev_hold(state->in);
>  	dev_hold(state->out);

Please follow up and add a ref tracker to this?