Re: [PATCH] net: af_packet: don't call tpacket_destruct_skb() until the skb is sent out

[Eric Dumazet <eric.dumazet@gmail.com>]

Le vendredi 10 septembre 2010 à 18:58 +0200, Eric Dumazet a écrit :
> Le samedi 11 septembre 2010 à 00:47 +0800, Changli Gao a écrit :
> > On Fri, Sep 10, 2010 at 10:26 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> 
> 
> > > Are you sure sock_wfree(skb) is still needed ?
> > 
> > sock_wfree(skb) is also used to wake up the users who sleep on
> > poll(2). If sock_wfree(skb) is moved into skb->destructor(), and
> > called before skb is sent out, pollers will be waked up without
> > POLLOUT, and since the later skb_shinfo(skb)->destructor() doesn't
> > wake up the pollers, POLLOUT events will be lost, and the poller will
> > be blocked forever.
> > 
> 
> Then implement poll() to use the number of available slots.
> (not use the default poll() that relies on generic sk / inet queues and
> counters)
> 
> Really, sock_wfree() cannot be used at all, or we also must disable
> early orphaning of these skbs.
> 
> Goal is to replace skb->destructor use in af_packet by
> shinfo->destructor, not mix the two.

Thinking again about this, we also might avoid taking references on
pages and releasing references too.

shinfo->destructor should replace the skb_release_data() logic,
not complement it.

if (shinfo->destructor) {
	shinfo->destructor(skb);
} else {
	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
		put_page(skb_shinfo(skb)->frags[i].page);
	if (skb_has_frag_list(skb))
	....
	kfree(skb->head);
}


As long as the mmap zone is correctly protected in af_packet code, of
course (not releasing it as long as some packets are still in flight)