On 11/28/2018 03:06 AM, Pan Bian wrote:
> The buffer skb is freed via dev_kfree_skb in a loop. After freeing skb,
> the value of packet_count is updated via packet_count++. If packet_count
> happens to equal the upper bound budget, the loop will be broken and skb
> may be assigned to rdata->state
The buffer skb is freed via dev_kfree_skb in a loop. After freeing skb,
the value of packet_count is updated via packet_count++. If packet_count
happens to equal the upper bound budget, the loop will be broken and skb
may be assigned to rdata->state.skb. Resulting that rdata->state.skb may
point
