Re: [PATCH] arp_queue: serializing unlink + kfree_skb

[Anton Blanchard <anton@samba.org>]

 
Hi,

> For example, in this particular case, a more sinister (but probably
> impossible for sk_buff objects) problem would be for the list removal
> itself to be delayed until after the the kfree_skb.  This could
> potentially mean that we're reading/writing memory that's already
> been freed.
> 
> Perhaps we should always add a barrier to such operations.  So
> kfree_skb would become
> 
> 	if (atomic_read(&skb->users) != 1) {
> 		smp_mb__before_atomic_dec();
> 		if (!atomic_dec_and_test(&skb->users))
> 			return;
> 	}
> 	__kfree_skb(skb);

Architectures should guarantee that any of the atomics and bitops that
return values order in both directions. So you dont need the
smp_mb__before_atomic_dec here.

It is, however, required on the atomics and bitops that dont return
values. Its difficult stuff, everyone gets it wrong and Andrew keeps
hassling me to write up a document explaining it.

Anton