On Tue, Nov 13, 2018 at 8:29 PM Anand H. Krishnan <anandhkrish...@gmail.com> wrote: > > skb_scrub_packet calls skb_orphan and from there the destructor is called.
Not since commit 9c4c325252c54b34d53b3d0ffd535182b744e03d skbuff: preserve sock reference when scrubbing the skb. v4.19-rc1~140^2~523^2 But the general issue is valid that the tx_ring slot should not be released until all users of the pages are freed, not just when the skb is orphaned (e.g., on skb_set_owner_r). I think that this can happen even on a transmit to a physical nic, if a clone is queued for reception on a packet socket. That clone does not clone the destructor, so if the reader is slow, the slot may be released from consume_skb on the original path. I have not verified this yet. But if correct, then the long term solution is to use refcounted uarg, similar to msg_zerocopy.
