David Miller  wrote:

quoted text
>

> diff --git a/net/core/skbuff.c b/net/core/skbuff.c

> index 5110b35..05126da 100644

> --- a/net/core/skbuff.c

> +++ b/net/core/skbuff.c

> @@ -70,12 +70,17 @@

> static struct kmem_cache *skbuff_head_cache __read_mostly;

> static struct kmem_cache *skbuff_fclone_cache __read_mostly;

>

> +static void skb_release_data(struct sk_buff *skb);

> +

> static void sock_pipe_buf_release(struct pipe_inode_info *pipe,

>                                  struct pipe_buffer *buf)

> {

>        struct sk_buff *skb = (struct sk_buff *) buf->private;

>

> -       kfree_skb(skb);

> +       if (skb)

> +               skb_release_data(skb);

> +       else

> +               put_page(buf->page);

> }

Unfortunately this won't work, not even for network destinations.
The reason is that this gets called as soon as the destination's

splice hook returns, for networking that means when sendpage returns.
So by that time we'll still be left with just a page reference

on a page where the slab memory may already have been freed.
To make this work we need to get the destination's splice hooks

to acquire this reference.
Cheers,

--

Visit Openswan at http://www.openswan.org/

Email: Herbert Xu ~{PmV>HI~}

Home Page: http://gondor.apana.org.au/~herbert/

PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

--

To unsubscribe from this list: send the line "unsubscribe netdev" in

the body of a message to majordomo@vger.kernel.org

More majordomo info at  http://vger.kernel.org/majordomo-info.html