Re: [PATCH] PPPOE can kfree SKB twice (was Re: kernel panic problem. (smp, iptables?))

[kuznet@xxxxxxxxxxxxx]

Hello!

SOme short comment on the patch:


> -     dev_queue_xmit(skb);
> +     /* The skb we are to transmit may be a copy (see above).  If
> +      * this fails, then the caller is responsible for the original
> +      * skb, otherwise we must free it.  Also if this fails we must
> +      * free the copy that we made.
> +      */
> +
> +     if (dev_queue_xmit(skb)<0) {

dev_queue_xmit _frees_ frame, not depending on return value.
Return value is not a criterium to assume anything.



> +             if (old_skb) {
> +                     /* The skb we tried to send was a copy.  We
> +                      * have to free it (the copy) and let the
> +                      * caller deal with the original one.
> +                      */
> +                     skb_unlink(skb);

So, do you pass to dev_queue_xmit some skb, which is on some list?
Not a good idea. Please, clone it and submit clone, if you need to hold
original in some list.

Alexey