Re: [PATCH net v1] mac802154: avoid extra skb references in RX queues

On 05/09/2026 at 14:15:23 +08, Xuanqiang Luo [off-list ref] wrote:

From: Xuanqiang Luo <redacted>

__ieee802154_rx_handle_packet() passes each cloned skb to
ieee802154_subif_frame() and does not release it after the call. The
callee consumes the skb on every path: it either frees it, hands it to
the networking stack, or stores it in a queued RX descriptor.

The beacon and MAC command paths nevertheless call skb_get() before
storing the skb. The worker drops only that additional reference, leaving
the original clone reference without an owner and leaking every queued
skb.

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>