On 10/27/20 12:34 PM, Flavio Leitner wrote:
> On Wed, Oct 14, 2020 at 03:22:48PM +0800, [email protected] wrote:
>> From: Yi Yang <[email protected]>
>>
>> shinfo is used to store reference counter and free callback
>> of an external buffer, but it is stored in mbuf if the mbuf
>> has tailroom for it.
>>
>> This is wrong because the mbuf (and its data) can be freed
>> before the external buffer, for example:
>>
>> pkt2 = rte_pktmbuf_alloc(mp);
>> rte_pktmbuf_attach(pkt2, pkt);
>> rte_pktmbuf_free(pkt);
How is that possible with OVS? Right now OVS doesn't support multi-segement
mbufs and will, likely, not support them in a near future because it requires
changes all other the codebase.
Is there any other scenario that could lead to issues with current OVS
implementation?
>>
>> After this, pkt is freed, but it still contains shinfo, which
>> is referenced by pkt2.
>>
>> Fix this by always storing shinfo at the tail of external buffer.
>>
>> Fixes: 29cf9c1b3b9c ("userspace: Add TCP Segmentation Offload support")
>> Co-authored-by: Olivier Matz <[email protected]>
>> Signed-off-by: Olivier Matz <[email protected]>
>> Signed-off-by: Yi Yang <[email protected]>
>> ---
>
> Acked-by: Flavio Leitner <[email protected]>
>
> Thanks Yi,
> fbl
>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
