Peter Zijlstra a écrit :

On Thu, 2008-11-13 at 14:15 +0100, Eric Dumazet wrote:

quoted

+begin:
+       sk_nulls_for_each_rcu(sk, node, &head->chain) {
                if (INET_MATCH(sk, net, hash, acookie,
+                                       saddr, daddr, ports, dif)) {
+                       if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
+                               goto begintw;
+                       if (unlikely(!INET_MATCH(sk, net, hash, acookie,
+                               saddr, daddr, ports, dif))) {
+                               sock_put(sk);
+                               goto begin;
+                       }

This is the validation step that verifies the race opened by using
SLAB_DESTROY_BY_RCU, right?

The atomic_inc_not_zero() is not related to SLAB_DESTROY_BY_RCU but
classic RCU lookup. A writer can delete the item right before we try to use it.

Next step is necessary in case the deleted item was re-allocated and inserted
in a hash chain (this one or another one, it doesnt matter). In this case,
previous atomic_inc_not_zero test will succeed. So we must check again the item
we selected (and refcounted) is the one we were searching.

So yes, this bit should be documented, since SLAB_DESTROY_BY_RCU is
not really used in linux kernel at this moment.

Does it make sense to add a little comment to these validation steps to
keep people on their toes and aware of the trickery?

Yes, you are right.

Thanks