Subject: [PATCH net-next 0/2] Address reference counting issues with
 sock_queue_err_skb
To: netdev@vger.kernel.org, linux-wireless@vger.kernel.org
From: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: johannes@sipsolutions.net, davem@davemloft.net,
	eric.dumazet@gmail.com, linville@tuxdriver.com
Date: Wed, 10 Sep 2014 18:04:42 -0400
Message-ID: <20140910215837.23225.39149.stgit@ahduyck-bv4.jf.intel.com> (sfid-20140911_001330_883456_303B19D1)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Sender: linux-wireless-owner@vger.kernel.org

After looking over the code for skb_clone_sk after some comments made by
Eric Dumazet I have come to the conclusion that skb_clone_sk is taking the
correct approach in how to handle the sk_refcnt when creating a buffer that
is eventually meant to be returned to the socket via the sock_queue_err_skb
function.

However upon review of other callers I found what I believe to be a
possible reference count issue in the path for handling "wifi ack" packets.
To address this I have applied the same logic that is currently in place so
that the sk_refcnt will be forced to stay at least 1, or we will not
provide an skb to return in the sk_error_queue.

---

Alexander Duyck (2):
      skb: Add documentation for skb_clone_sk
      mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path


 net/core/skbuff.c |   18 ++++++++++++++++++
 net/mac80211/tx.c |   15 ++++-----------
 2 files changed, 22 insertions(+), 11 deletions(-)

--