Re: [PATCH 2.6.26-rc4] fix double call of kfree_skb in net/llc/llc_sap.c

["Dmitry Petukhov" <dmgenp@gmail.com>]

2008/5/27 Dmitry Petukhov <dmgenp@gmail.com>:
> 2008/5/27 Wei Yongjun <yjwei@cn.fujitsu.com>:
>
>> Normally,
>>
>> skb_get()         (**return )
>> kfree_skb()
>>
>> will do nothing. If you return with no kfree_skb(), it will let that skb can
>> not be free.
>>
>> skb_get()
>> kfree_skb()
>> kfree_skb()
>>
>> do the real free.
>
> Yeah, you're right. Looks like we mislocated the root of our problem
> (llc socket hangs on receive). Will debug further .
> Thanks for explanation.
>

Looks like we found the real root of our problem.
file net/llc/llc_sap.c:

skb_set_owner_r is called before llc_sap_rcv in two places (lines 363, 384)
skb_set_owner_r do this:
atomic_add(skb->truesize, &sk->sk_rmem_alloc);

and in llc_sap_state_process, on line 223 sock_queue_rcv_skb is
called, which also calls set_owner_r,
which in turn adds skb->truesize to sk->sk_rmem_alloc once more.
This double-addition results in sk_mem_alloc growth to exceed sk_rcvbuf.
We can observe this in  /proc/net/llc/socket, rx_queue field.
after this value exceeds sk_rcvbuf, sock_queue_rcv_skb always return
-ENOMEM, and
socket stops receiving.

//note: please CC me on reply, i'm not subscribed to the list.