Re: [PATCH] net: Fix sk reference counting in ip_push_pending_frames and ip6_push_pending_frames

[John Dykstra <john.dykstra1@gmail.com>]

On Sat, 2009-07-11 at 21:39 +0200, Eric Dumazet wrote:
> John Dykstra a écrit :
> > Commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 "net: No more
> expensive
> > sock_hold()/sock_put() on each tx" used sk_wmem_alloc rather than
> the struct sock reference
> > count to track in-flight transmit-path packets.  However, it missed
> the __sock_put() calls
> > in ip_push_pending_frames() and ip6_push_pending_frames().  This
> results in too-small
> > reference counts when UDP or RAW sockets are used to send more than
> one MTU of data.  This 
> > in turn could lead to struct sock being freed and reused while it is
> still part of an
> > active socket.
> > 
> > A wide variety of socket symptoms may be fixed by this patch.  It
> also fixes one cause 
> > of WARN_ON's in sk_del_node_init() and sk_nulls_del_node_init_rcu().
> > 
> > Signed-off-by: John Dykstra <john.dykstra1@gmail.com>
> 
> Nice, but are you aware same patch was already posted, and is waiting
> for David
> approval ?
> 
> http://patchwork.ozlabs.org/patch/29618/

<sigh>  No, I wasn't.  It took me a while to track down where the
reference counts were going wrong, and during that time I wasn't
tracking netdev traffic.

At least it's fixed.

  --  John