On Mon, 2 Dec 2024 18:49:01 +0500 Nikita Yushchenko wrote: > If error path is taken while filling descriptor for a frame, skb > pointer is left in the entry. Later, on the ring entry reuse, the > same entry could be used as a part of a multi-descriptor frame, > and skb for that new frame could be stored in a different entry. > > Then, the stale pointer will reach the completion routine, and passed > to the release operation. > > Fix that by clearing the saved skb pointer at the error path. Why not move the assignment down, then? After we have successfully mapped all entries? Coincidentally rswitch_ext_desc_set() calls rswitch_ext_desc_set_info1() for each desc, potentially timestamping the same frame multiple times? Isn't that an issue? I agree with Jake that patches 4 and 5 don't seem like obvious fixes, would be great if you could post them as separate series, they need to go to a different tree. -- pw-bot: cr
