nsim_do_psp() takes an extra reference to the PSP skb extension so the
extension survives __dev_forward_skb(). That forward path scrubs the skb
and drops attached skb extensions before nsim_psp_handle_ext() can
reattach the PSP metadata.

If __dev_forward_skb() fails in nsim_forward_skb(), the function returns
before nsim_psp_handle_ext() can attach that extension to the skb, leaving
the extra reference leaked.

Drop the saved PSP extension reference before returning from the
forward-failure path. Guard the put because plain or non-decapsulated
traffic can also fail forwarding without ever taking the extra PSP
reference.

Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
---
 drivers/net/netdevsim/netdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 5ec028a00c6200ee6de2e931a2040d56f9523006..3645ebde049a0245febbd454151745675ef80b23 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -109,8 +109,11 @@ static int nsim_forward_skb(struct net_device *tx_dev,
 	int ret;
 
 	ret = __dev_forward_skb(rx_dev, skb);
-	if (ret)
+	if (ret) {
+		if (psp_ext)
+			__skb_ext_put(psp_ext);
 		return ret;
+	}
 
 	nsim_psp_handle_ext(skb, psp_ext);

On 3/17/26 02:14, Wesley Atwell wrote:
> nsim_do_psp() takes an extra reference to the PSP skb extension so the
> extension survives __dev_forward_skb(). That forward path scrubs the skb
> and drops attached skb extensions before nsim_psp_handle_ext() can
> reattach the PSP metadata.
>
> If __dev_forward_skb() fails in nsim_forward_skb(), the function returns
> before nsim_psp_handle_ext() can attach that extension to the skb, leaving
> the extra reference leaked.
>
> Drop the saved PSP extension reference before returning from the
> forward-failure path. Guard the put because plain or non-decapsulated
> traffic can also fail forwarding without ever taking the extra PSP
> reference.
>
> Fixes: f857478d6206 ("netdevsim: a basic test PSP implementation")
> Signed-off-by: Wesley Atwell <atwellwea@gmail.com>


Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>