This is the mail archive of the
ecos-discuss@sources.redhat.com
mailing list for the eCos project.
RE: TCP driver eth_drv.c -- bug fix
- To: Jon Hartley <jdh at cea dot com dot au>
- Subject: RE: [ECOS] TCP driver eth_drv.c -- bug fix
- From: Gary Thomas <gthomas at cambridge dot redhat dot com>
- Date: Tue, 03 Jul 2001 07:51:46 -0600 (MDT)
- Cc: Jonathan Larmour <jlarmour at redhat dot com>,ecos-discuss at sources dot redhat dot com
- Organization: Red Hat, Inc.
I agree that this should be changed.
Next time, please send a context diff. It is sometimes quite hard to find
the needle in a haystack of code (I missed your change the first time I
scanned this).
On 03-Jul-2001 Jon Hartley wrote:
> Hi,
>
> Correct me if i'm wrong but it appears that a freed mbuf pointer (top) is
> passed to ether_input() in eth_drv_recv() when MGET fails in the while loop.
> I suspect this was causing bad things to happen to our mbufs, resulting in
> mbuf loss and crash etc (depending on what ether_input does with it).
>
> static void
> eth_drv_recv(struct eth_drv_sc *sc, int total_len)
> ...
> while (total_len > 0) {
> if (top) {
> MGET(m, M_DONTWAIT, MT_DATA);
> if (m == 0) {
> m_freem(top);
>#ifdef CYGPKG_IO_ETH_DRIVERS_WARN_NO_MBUFS
> diag_printf("out of MBUFs [2]");
>#endif
> sg_list[sg_len].buf = (CYG_ADDRESS)0;
> sg_list[sg_len].len = 0;
> sg_len = 1;
> --> top = 0; //jdh
> break;
> }
> mlen = MLEN;
> }
>
> ...
>
> More mbufs fixes to follow (in if_quicc.c).
>
> Cheers,
> Jon.