skb_recycle bug

[Benjie Chen]

hi. thanks for your bug report.

> if (!skb->cloned || atomic_dec_and_test(skb_datarefp(skb)))
> 
> this line decrease the skb rep count and if its not 0 the it calls
> kfree_skbmem
> witch decrease the count as well so the memory is freed and there are still
> skb clones in the system.

this is a bug in the 1.0.6 release that has been fixed in the 1.1b1 release
that is currently available on our website.

> I think the line should be
> 
>       if ((skb->cloned != 1) && (atomic_read(skb_datarefp(skb)) == 1))
> 
> and this solves the problem

actually it should stay as 

  if (!skb->cloned || atomic_dec_and_test(skb_datarefp(skb)))

except in the else case it calls kmem_cache_free directly instead of 
kfree_skbmem. the reason is that we want to recycle in both the situation
that skb->clone is not 1 and we are the last ref to the skb data.

benjie


-- 
benjie chen
benjie at lcs.mit.edu