On Fri, Jul 25, 2008 at 11:37:57AM +0000, Jarek Poplawski wrote:

On Fri, Jul 25, 2008 at 03:57:12AM -0700, David Miller wrote:

...

quoted

It should be OK here, we have the root qdisc locked, so nobody
can remove it from the queue and if we got NET_XMIT_SUCCESS that
thing must not have been freed.

And anyways, we can't know the qdisc_pkt_len() until the enqueue
fucntion has been called.

OK, I see htb did this earlier with ".packets", so it looks like I'm
wrong with this - sorry! (Anyway, it seems to unnecessarily restrict
the way qdisc are working.)

quoted

Even TCP depends upon that NET_XMIT_* return value having some real
meaning, remember the HTB bug we tracked down last week? :-)

As a matter of fact it's a good example: in your patch we have this:

+		ret = cl->un.leaf.q->enqueue(skb, cl->un.leaf.q);
+		if (ret == NET_XMIT_DROP) {
+			sch->qstats.drops++;
+			cl->qstats.drops++;
+		} else {
+			cl->bstats.packets +=
+				skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
+			cl->bstats.bytes += skb->len;

So, if something works like noop_enqueue() and returns NET_XMIT_CN
here, we're just using skb after kfree...

Jarek P.