From: Jarek Poplawski <redacted>
Date: Fri, 25 Jul 2008 11:53:55 +0000

On Fri, Jul 25, 2008 at 11:37:57AM +0000, Jarek Poplawski wrote:

As a matter of fact it's a good example: in your patch we have this:

+		ret = cl->un.leaf.q->enqueue(skb, cl->un.leaf.q);
+		if (ret == NET_XMIT_DROP) {
+			sch->qstats.drops++;
+			cl->qstats.drops++;
+		} else {
+			cl->bstats.packets +=
+				skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
+			cl->bstats.bytes += skb->len;

So, if something works like noop_enqueue() and returns NET_XMIT_CN
here, we're just using skb after kfree...

noop_enqueue() can only be a root qdisc, never a leaf hanging off of a
class

What TCP depends upon is that DROP means DROP, and that the
packet never reached the device and has been freed.