[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[lwip-users] Found bug in pbuf.c
From: |
Konrad, Guido |
Subject: |
[lwip-users] Found bug in pbuf.c |
Date: |
Tue, 27 May 2003 16:13:34 +0200 |
Hi,
in my last mail I asked for help due to a problem with memory leaks. It
seems to me that this problem is related to the ref counter in pbufs if
pbufs are chained. Function pbuf_chain increments the ref counter of the
chained pbuf, (e.g. the second), but pbuf_free does not decrease the ref
counter. So only the first pbuf of a chain is freed.
E.g using netconn_write with copy = 1 leads to unfreed pbufs because
tcp_seg_free(next); in tcp_in.c after ACK only frees the first pbuf.
I solved the problem with the following bug fix in pbuf.c, Line 633, but I
assume there is a better solution:
while (p != NULL) {
/* all pbufs in a chain are referenced at least once */
LWIP_ASSERT("pbuf_free: p->ref > 0", p->ref > 0);
p->ref--;
/* this pbuf is no longer referenced to? */
if (p->ref == 0) {
/* remember next pbuf in chain for next iteration */
q = p->next;
/* is this a pbuf from the pool? */
if (p->flags == PBUF_FLAG_POOL) {
p->len = p->tot_len = PBUF_POOL_BUFSIZE;
p->payload = (void *)((u8_t *)p + sizeof(struct pbuf));
PBUF_POOL_FREE(p);
/* a RAM/ROM referencing pbuf */
} else if (p->flags == PBUF_FLAG_ROM || p->flags ==
PBUF_FLAG_REF) {
memp_freep(MEMP_PBUF, p);
/* pbuf with data */
} else {
mem_free(p);
}
count++;
/* proceed to next pbuf */
gko-> if( q != NULL ) q->ref--;
p = q;
/* p->ref > 0, this pbuf is still referenced to */
/* (so the remaining pbufs in chain as well) */
} else {
/* stop walking through chain */
p = NULL;
}
}
Please comment.
-- Guido Konrad
- [lwip-users] Found bug in pbuf.c,
Konrad, Guido <=