On Mon, 2018-11-26 at 12:59 -0500, Willem de Bruijn wrote:

The callers of this function do flush the queue of the other skbs on
error, but only after the call to sock_zerocopy_put_abort.

sock_zerocopy_put_abort depends on total rollback to revert the
sk_zckey increment and suppress the completion notification (which
must not happen on return with error).

I don't immediately have a fix. Need to think about this some more..

[still out of sheer ignorance] How about tacking a refcnt for the whole
ip_append_data() scope, like in the tcp case? that will add an atomic
op per loop (likely, hitting the cache) but will remove some code hunk
in sock_zerocopy_put_abort() and sock_zerocopy_alloc().

Cheer,

Paolo