[lwip-devel] [bug #11400] ARP multi-packet-queue modifies TCP unsent/unacked segment packet pbuf chain into packet queue

[Simon Goldschmidt]

Follow-up Comment #15, bug #11400 (project lwip):

(to comment #12):

I agree that copying to PBUF_RAM is not a good idea. Using PBUF_POOL would be
my favourite (and I would change it to that before checking in).

Regarding the original method: that's the way it's solved right now (in CVS
HEAD). But I'm not sure this solves all problems:

1. If the first pbuf in a chain given to pbuf_take() is a PBUF_REF, you will
change that pbuf into a PBUF_POOL (or PBUF_RAM) and free the old PBUF_REF.
But tcp might be referencing  that initial pbuf directly (in the send-queue)
and so it now might point to invalid data!

2. Calling pbuf_ref later on this new pbuf queue, the first pbuf will get a
refcount of 2 but only ARP knows of it -> memory leak.

The reason I suggested this new patch is that it is known nowhere in the
stack how long packets are being queued. By copying queued packets into new
pbufs, one could minimize the effect ARP queueing has on the rest of the
stack.

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?11400>

_______________________________________________
  Nachricht geschickt von/durch Savannah
  http://savannah.nongnu.org/