[ECOS] mbuf leakage in if_i82559.c ?

[ECOS] mbuf leakage in if_i82559.c ?

[Larice Robert]

Hello,

i think there is possible mbuf leakage in if_i82559.c
could you please verify this ?

as far as i understand this, eth_drv.c hands over responsibility for mbufs
to if_i82559.c with the parameter key of the function i82559_send(...key...)

later if_i82599.c gives them back to eth_drv.c with the parameter key
of the function eth_drv_tx_done(...key...)

BUT, when i82559_send thinks its queue is full, it will simply drop this
key. is this ok ? is there somewhere another cleanup mechanism which
i've not seen so far ?

Robert Larice

----------------------------------------------------------------------

file packages/devs/eth/intel/i82559/current/src/if_i82559.c

TxDone(struct i82559* p_i82559) {
   ...
   while(1) {
     ...
     unsigned long key = p_i82559->tx_keys[ tx_descriptor_remove ];
     ...
     (sc->funs->eth_drv->tx_done)( sc, key, 1 /* status */ );
     ...
   }
}

static void
i82559_send(struct eth_drv_sc *sc,
            struct eth_drv_sg *sg_list, int sg_len, int total_len,
            unsigned long key)
{
  ...
  if ( p_i82559->tx_queue_full ) {
    ...
    // nothing done with key
    //    !!!!! I think an mbuf is lost here !!!!
    ...
  }
  else {
    ...
    p_i82559->tx_keys[tx_descriptor_add] = key;
    ...
  }

  ...
}

file packages/io/eth/current/src/net/eth_drv.c

static void
eth_drv_tx_done(struct eth_drv_sc *sc, CYG_ADDRESS key, int status)
{
    ...
    struct mbuf *m0 = (struct mbuf *)key;
    ...
    if (m0) { 
        mbuf_key = m0;
        m_freem(m0);
    }
    ...
}

-- 
Before posting, please read the FAQ: http://sources.redhat.com/fom/ecos
and search the list archive: http://sources.redhat.com/ml/ecos-discuss

Re: [ECOS] mbuf leakage in if_i82559.c ?

[Gary Thomas]

On Thu, 2003-11-20 at 05:34, Larice Robert wrote:
> Hello,
> 
> i think there is possible mbuf leakage in if_i82559.c
> could you please verify this ?
> 
> as far as i understand this, eth_drv.c hands over responsibility for mbufs
> to if_i82559.c with the parameter key of the function i82559_send(...key...)
> 
> later if_i82599.c gives them back to eth_drv.c with the parameter key
> of the function eth_drv_tx_done(...key...)
> 
> BUT, when i82559_send thinks its queue is full, it will simply drop this
> key. is this ok ? is there somewhere another cleanup mechanism which
> i've not seen so far ?
> 

This would be a leak - if it could happen.  However, it should never
happen since the XXX_send() routine will only be called if the 
XXX_can_send() routine says that the device has space.  So if there
*is* space, then the packet would not be dropped, so there is no leak.

-- 
Gary Thomas <gary@mlbassoc.com>
MLB Associates


-- 
Before posting, please read the FAQ: http://sources.redhat.com/fom/ecos
and search the list archive: http://sources.redhat.com/ml/ecos-discuss