Eric Dumazet [off-list ref] wrote:

Thanks for taking a look Florian.

Perhaps not messing with truesize at all would help ?

Something based on this POC :

                spin_lock(&qp->q.lock);
+               if (!qp->q.sk) {
+                       struct sock *sk = skb->sk;

+                       if (sk && refcount_inc_not_zero(&sk->sk_refcnt))
+                               qp->q.sk = sk;

Unfortunetely I did not get this to work.

sk_refcnt is 0.  sk is kept alive by sock_wfree destructor.

I don't know how to recover from this, refcnt cannot be "repaired"
anymore.

I could artificially inflate sk_wmem counter by 1, to prevent release,
but that needs yet another sock_wfree-like destructor.

I'm already not sure how this existing scheme works, there are
multiple places that check for skb->destructor == sock_wfree,
yet we have is_skb_wmem helper that checks __sock_wfree and tcp_wfree.

Removing defrag from output seems like best option, but it will
surely break some scenarios.

Or, I could just fail reasm if sk refcount is already 0, that would
likely work too?