At 2017-08-10 02:18:44, "Cong Wang" <xiyou.wangc...@gmail.com> wrote:
>On Tue, Aug 8, 2017 at 10:13 PM, Gao Feng <gfree.w...@vip.163.com> wrote:
>> Maybe I didn't show my explanation clearly.
>> I think it won't happen as I mentioned in the last email.
>> Because the pptp_release invokes the synchronize_rcu to make sure it, and
>> actually there is no one which would invoke del_chan except pptp_release.
>> It is guaranteed by that the pptp_release doesn't put the sock refcnt until
>> complete all cleanup include marking sk_state as PPPOX_DEAD.
>> In other words, even though the pptp_release is not the last user of this
>> sock, the other one wouldn't invoke del_chan in pptp_sock_destruct.
>> Because the condition "!(sk->sk_state & PPPOX_DEAD)" must be false.
>Only if sock->sk is always non-NULL for pptp_release(), which
>is what I am not sure. If you look at other ->release(), similar checks
>are there too, so not just for pptp.
Yes. It seems only if the release() is invoked twice, the sock->sk would be
But I don't find there is any case which could cause it.
>> As summary, the del_chan and pppox_unbind_sock in pptp_sock_destruct are
>> And it even brings confusing.
>Sorry, I can't draw any conclusion for this.
Thank you all the same, and I have learn a lot from you :)
Wish someone which is familiar with these codes could give more details and