After looking over the code for skb_clone_sk after some comments made by Eric Dumazet I have come to the conclusion that skb_clone_sk is taking the correct approach in how to handle the sk_refcnt when creating a buffer that is eventually meant to be returned to the socket via the sock_queue_err_skb function. However upon review of other callers I found what I believe to be a possible reference count issue in the path for handling "wifi ack" packets. To address this I have applied the same logic that is currently in place so that the sk_refcnt will be forced to stay at least 1, or we will not provide an skb to return in the sk_error_queue. --- Alexander Duyck (2): skb: Add documentation for skb_clone_sk mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path net/core/skbuff.c | 18 ++++++++++++++++++ net/mac80211/tx.c | 15 ++++----------- 2 files changed, 22 insertions(+), 11 deletions(-) -- -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html