[ovs-dev] [PATCH v2 1/2] datapath: Free skb(s) on recirculation error

Jesse Gross jesse at nicira.com
Mon May 12 22:48:30 UTC 2014

On Sat, May 10, 2014 at 7:46 PM, Simon Horman <horms at verge.net.au> wrote:
> It is my understanding that on error execute_recirc() does not free the
> skb passed to it.
> Assuming this is true then on error skb should always be freed
> if an error occurs in execute_recirc().
> And if recirc_skb differs from skb, because it is a clone of skb,
> then it should also be freed.
> Signed-off-by: Simon Horman <horms at verge.net.au>

I think this can introduce a double free in the normal case where
execute_recirc() and is the last action. In this case, we free the skb
in execute_recirc() and then continue down to the bottom of the
do_execute_actions() since we are no longer returning and free the
(same) skb again.

It may make sense to just have execute_recirc() always take ownership
of the packet and free the skb on error itself.

More information about the dev mailing list