On Sat, May 10, 2014 at 7:46 PM, Simon Horman <ho...@verge.net.au> wrote: > It is my understanding that on error execute_recirc() does not free the > skb passed to it. > > Assuming this is true then on error skb should always be freed > if an error occurs in execute_recirc(). > > And if recirc_skb differs from skb, because it is a clone of skb, > then it should also be freed. > > Signed-off-by: Simon Horman <ho...@verge.net.au>
I think this can introduce a double free in the normal case where execute_recirc() and is the last action. In this case, we free the skb in execute_recirc() and then continue down to the bottom of the do_execute_actions() since we are no longer returning and free the (same) skb again. It may make sense to just have execute_recirc() always take ownership of the packet and free the skb on error itself. _______________________________________________ dev mailing list dev@openvswitch.org http://openvswitch.org/mailman/listinfo/dev
