Re: [Xen-devel] network hang trigger

[Bin Ren <br260@xxxxxxxxx>]

Here is what I find out:

In netfront.c, the transmit function is:

network_start_xmit(struct sk_buff *skb, struct net_device *dev)

Currently, whenever there is an error, it returns 1 or -ENOBUFS 
***WITHOUT*** freeing the ***skb***. This is based on the assumption that 
the caller, seeing a non-zero return value, will free the ***skb***. Let's 
take a look at the caller:
int dev_queue_xmit(struct sk_buff *skb)

in file net/core.c
======================================
if (!dev->hard_start_xmit(skb, dev)) {
       HARD_TX_UNLOCK_BH(dev);
       goto out;
}
...

out_kfree_skb:
       kfree_skb(skb);
out:
       return rc;
======================================

Bingo, it doesn't. And take a look at other network driver source codes, 
e.g. 8139too.c, 3c501.c etc, they all ***free skb*** upon error and 
***always return 0***. This is *hidden contract* between the caller and the 
callee.
So, skbuffs don't get freed until gc'ed.

I'm going to modify the files and see the result.
Keep tuned.

-- Bin Ren


-------------------------------------------------------
This SF.Net email is sponsored by: thawte's Crypto Challenge Vl
Crack the code and win a Sony DCRHC40 MiniDV Digital Handycam
Camcorder. More prizes in the weekly Lunch Hour Challenge.
Sign up NOW http://ad.doubleclick.net/clk;10740251;10262165;m
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel