Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755114AbZA0Lsx (ORCPT ); Tue, 27 Jan 2009 06:48:53 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752741AbZA0Lsm (ORCPT ); Tue, 27 Jan 2009 06:48:42 -0500 Received: from rhun.apana.org.au ([64.62.148.172]:52839 "EHLO arnor.apana.org.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752703AbZA0Lsl (ORCPT ); Tue, 27 Jan 2009 06:48:41 -0500 Date: Tue, 27 Jan 2009 22:48:05 +1100 From: Herbert Xu To: Jarek Poplawski Cc: David Miller , zbr@ioremap.net, w@1wt.eu, dada1@cosmosbay.com, ben@zeus.com, mingo@elte.hu, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, jens.axboe@oracle.com Subject: Re: [PATCH v3] tcp: splice as many packets as possible at once Message-ID: <20090127114805.GA30982@gondor.apana.org.au> References: <20090125.212203.15909648.davem@davemloft.net> <20090127071130.GA29125@gondor.apana.org.au> <20090127075418.GB4197@ff.dom.local> <20090127100958.GA30239@gondor.apana.org.au> <20090127103511.GE4197@ff.dom.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090127103511.GE4197@ff.dom.local> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1366 Lines: 30 On Tue, Jan 27, 2009 at 10:35:11AM +0000, Jarek Poplawski wrote: > > > > Yes, but ip_append_data() (and skb_append_datato_frags() for > > > NETIF_F_UFO only, so currently not a problem), uses this differently, > > > and these pages in sk->sk_sndmsg_page could leak or be used after > > > kfree. (I didn't track locking in these other places). > > > > It'll be freed when the socket is freed so that should be fine. > > I don't think so: these places can overwrite sk->sk_sndmsg_page left > after tcp_sendmsg(), or skb_splice_bits() now, with NULL or a new > pointer without put_page() (they only reference copied chunks and > expect auto freeing). On the other hand, if tcp_sendmsg() reads after > them it could use a pointer after the page is freed, I guess. I wasn't referring to the first part of your sentence. That can't happen because they're only used for UDP sockets, this is a TCP socket. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/