tcp: fix zerocopy and notsent_lowat issues

My recent patch had at least three problems :

1) TX zerocopy wants notification when skb is acknowledged,
thus we need to call skb_zcopy_clear() if the skb is
cached into sk->sk_tx_skb_cache

2) Some applications might expect precise EPOLLOUT
notifications, so we need to update sk->sk_wmem_queued
and call sk_mem_uncharge() from sk_wmem_free_skb()
in all cases. The SOCK_QUEUE_SHRUNK flag must also be set.

3) Reuse of saved skb should have used skb_cloned() instead
of simply checking if the fast clone has been freed.

Fixes: 472c2e07eef0 ("tcp: add one skb cache for tx")
Signed-off-by: Eric Dumazet <[e-mail]>
Cc: Willem de Bruijn <[e-mail]>
Cc: Soheil Hassas Yeganeh <[e-mail]>
Acked-by: Soheil Hassas Yeganeh <[e-mail]>
Tested-by: Holger Hoffstätte <[e-mail]>
Signed-off-by: David S. Miller <[e-mail]>

include/net/sock.h

···
 
 static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
 {
-	if (!sk->sk_tx_skb_cache) {
-		sk->sk_tx_skb_cache = skb;
-		return;
-	}
 	sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
 	sk->sk_wmem_queued -= skb->truesize;
 	sk_mem_uncharge(sk, skb->truesize);
+	if (!sk->sk_tx_skb_cache) {
+		skb_zcopy_clear(skb, true);
+		sk->sk_tx_skb_cache = skb;
+		return;
+	}
 	__kfree_skb(skb);
 }
 

net/ipv4/tcp.c

···
 {
 	struct sk_buff *skb;
 
-	skb = sk->sk_tx_skb_cache;
-	if (skb && !size) {
-		const struct sk_buff_fclones *fclones;
-
-		fclones = container_of(skb, struct sk_buff_fclones, skb1);
-		if (refcount_read(&fclones->fclone_ref) == 1) {
-			sk->sk_wmem_queued -= skb->truesize;
-			sk_mem_uncharge(sk, skb->truesize);
+	if (likely(!size)) {
+		skb = sk->sk_tx_skb_cache;
+		if (skb && !skb_cloned(skb)) {
 			skb->truesize -= skb->data_len;
 			sk->sk_tx_skb_cache = NULL;
 			pskb_trim(skb, 0);
···
 	tcp_rtx_queue_purge(sk);
 	skb = sk->sk_tx_skb_cache;
 	if (skb) {
-		sk->sk_wmem_queued -= skb->truesize;
-		sk_mem_uncharge(sk, skb->truesize);
 		__kfree_skb(skb);
 		sk->sk_tx_skb_cache = NULL;
 	}