Re: [PATCH net] ixgbe: reserve TX timestamp after skb preparation

[Maciej Fijalkowski <maciej.fijalkowski@intel.com>]

On Mon, Oct 26, 2026 at 09:20:35AM +0100, Eric Dumazet wrote:
> ixgbe_xmit_frame_ring() takes an extra skb reference with skb_get()
> for the pending TX timestamp before preparing the skb for transmit.
> Several of the following steps may need to reallocate the skb head:
> 
> - ixgbe_tso() calls skb_cow_head(), which reaches pskb_expand_head()
>   when the header is cloned (e.g. a packet tap holds a clone).
> - ixgbe_tx_csum() falls back to skb_checksum_help() for unsupported
>   checksum offsets, which can call pskb_expand_head() through
>   skb_ensure_writable().
> - With DCB and a software VLAN tag, skb_cow_head() is called to
>   rewrite the VLAN priority.
> 
> pskb_expand_head() used to BUG() on shared skbs. Since commit
> c7d8bc3dd511 ("net: skbuff: don't BUG() on bad arguments to
> pskb_expand_head()") it returns -EINVAL instead, so these packets
> are dropped (TSO, DCB) or sent with an unfinished checksum
> (skb_checksum_help() errors are ignored by ixgbe_tx_csum()).
> 
> Reserve the TX timestamp right before ixgbe_tx_map(), after all skb
> preparation, as i40e and ice already do. The timestamp request
> remains covered on the FCoE path, and the cleanup on ixgbe_tx_map()
> failure is unchanged.
> 
> Fixes: 891dc0821d20 ("ixgbe: Add ptp work item to poll for the Tx timestamp")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>

> ---
> Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
> ---
>  drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 40 +++++++++++--------
>  1 file changed, 23 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index f91856498eb2d9e0e4173153c8c00bc2248bb708..b9496f0bee1312499f28c2f3c24fcff9a1e66e0d 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -9444,23 +9444,6 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
>  	}
>  	protocol = vlan_get_protocol(skb);
>  
> -	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
> -	    adapter->ptp_clock) {
> -		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
> -		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
> -					   &adapter->state)) {
> -			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
> -			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
> -
> -			/* schedule check for Tx timestamp */
> -			adapter->ptp_tx_skb = skb_get(skb);
> -			adapter->ptp_tx_start = jiffies;
> -			schedule_work(&adapter->ptp_tx_work);
> -		} else {
> -			adapter->tx_hwtstamp_skipped++;
> -		}
> -	}
> -
>  #ifdef CONFIG_PCI_IOV
>  	/*
>  	 * Use the l2switch_enable flag - would be false if the DMA
> @@ -9525,6 +9508,29 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
>  #ifdef IXGBE_FCOE
>  xmit_fcoe:
>  #endif /* IXGBE_FCOE */
> +	/* Reserve the Tx timestamp only after all skb preparation:
> +	 * skb_get() makes the skb shared, and pskb_expand_head()
> +	 * (reached from skb_cow_head() or skb_checksum_help())
> +	 * refuses shared skbs.
> +	 */
> +	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
> +	    adapter->ptp_clock) {
> +		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
> +		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
> +					   &adapter->state)) {
> +			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
> +			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
> +			first->tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
> +
> +			/* schedule check for Tx timestamp */
> +			adapter->ptp_tx_skb = skb_get(skb);
> +			adapter->ptp_tx_start = jiffies;
> +			schedule_work(&adapter->ptp_tx_work);
> +		} else {
> +			adapter->tx_hwtstamp_skipped++;
> +		}
> +	}
> +
>  	if (ixgbe_tx_map(tx_ring, first, hdr_len))
>  		goto cleanup_tx_timestamp;
>  
> -- 
> 2.53.0
> 
>