If error path is taken while filling descriptor for a frame, skb
pointer is left in the entry. Later, on the ring entry reuse, the
same entry could be used as a part of a multi-descriptor frame,
and skb for that new frame could be stored in a different entry.
Then, the stale pointer will reach the completion routine, and passed
to the release operation.
Fix that by clearing the saved skb pointer at the error path.
Why not move the assignment down, then? After we have successfully
mapped all entries?
That is a different possible way to fix the same issue. Either can be used.
Coincidentally rswitch_ext_desc_set() calls
rswitch_ext_desc_set_info1() for each desc, potentially timestamping
the same frame multiple times? Isn't that an issue?
Somebody familiar with how timestamping works shall comment on this.
I agree with Jake that patches 4 and 5 don't seem like obvious fixes,
would be great if you could post them as separate series, they need to
go to a different tree.
Ok, will repost.
Shall I use [PATCH net] for all?
Or [PATCH] for fixes and [PATCH net] for improvements?
Nikita
