From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: [PATCH v3] net: af_packet: don't call tpacket_destruct_skb()
 until the skb is sent out
Date: Thu, 23 Sep 2010 16:41:52 +0200
Message-ID: <1285252912.2509.29.camel@edumazet-laptop>
References: <1285236939-3239-1-git-send-email-xiaosuo@gmail.com>
	 <1285244970.2864.46.camel@edumazet-laptop>
	 <AANLkTik4d76GBa9Jwn9BOnC07_0CnMsy-XoKM_MhF_sc@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Cc: "David S. Miller" <davem@davemloft.net>,
	Oliver Hartkopp <socketcan@hartkopp.net>,
	"Michael S. Tsirkin" <mst@redhat.com>, netdev@vger.kernel.org
To: Changli Gao <xiaosuo@gmail.com>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-fx0-f46.google.com ([209.85.161.46]:57042 "EHLO
	mail-fx0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1753436Ab0IWOl6 (ORCPT
	<rfc822;netdev@vger.kernel.org>); Thu, 23 Sep 2010 10:41:58 -0400
Received: by fxm3 with SMTP id 3so76324fxm.19
        for <netdev@vger.kernel.org>; Thu, 23 Sep 2010 07:41:56 -0700 (PDT)
In-Reply-To: <AANLkTik4d76GBa9Jwn9BOnC07_0CnMsy-XoKM_MhF_sc@mail.gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

Le jeudi 23 septembre 2010 =C3=A0 22:17 +0800, Changli Gao a =C3=A9crit=
 :
> On Thu, Sep 23, 2010 at 8:29 PM, Eric Dumazet <eric.dumazet@gmail.com=
> wrote:
> > Le jeudi 23 septembre 2010 =C3=A0 18:15 +0800, Changli Gao a =C3=A9=
crit :
> >> Since skb->destructor() is used to account socket memory, and mayb=
e called
> >> before the skb is sent out, a corrupt skb maybe sent out finally.
> >>
> >> A new destructor is added into structure skb_shared_info(), and it=
 won't
> >> be called until the last reference to the data of an skb is put. a=
f_packet
> >> uses this destructor instead.
> >>
> >> Signed-off-by: Changli Gao <xiaosuo@gmail.com>
> >> ---
> >> v3: rename destructor to data_destructor, destructor_arg to data_d=
estructor_arg,
> >>     fix splice the skbs generated by AF_PACKET socket to the pipe.
> >
> > I dont understand this.
> >
> > Could you describe how splice(from af_packet to pipe) is possible w=
ith
> > af_packet send path ?
>=20
> af_packet sends packets to lo(127.0.0.1), and a local socket is
> receiving packets via splice.

Ouch

I am pretty sure too many things will break if we allow such packets to
get back in input path.

(think of tcp coalescing for example...)