[lwip-users] Found bug in pbuf.c

[Konrad, Guido]

Hi,

in my last mail I asked for help due to a problem with memory leaks. It
seems to me that this problem is related to the ref counter in pbufs if
pbufs are chained. Function pbuf_chain increments the ref counter of the
chained pbuf, (e.g. the second), but pbuf_free does not decrease the ref
counter. So only the first pbuf of a chain is freed.

E.g using netconn_write with copy = 1 leads to unfreed pbufs because
tcp_seg_free(next); in tcp_in.c after ACK only frees the first pbuf.

I solved the problem with the following bug fix in pbuf.c, Line 633, but I
assume there is a better solution:


    while (p != NULL) {
        /* all pbufs in a chain are referenced at least once */
        LWIP_ASSERT("pbuf_free: p->ref > 0", p->ref > 0);
        p->ref--;
        /* this pbuf is no longer referenced to? */
        if (p->ref == 0) {
            /* remember next pbuf in chain for next iteration */
            q = p->next;
            /* is this a pbuf from the pool? */
            if (p->flags == PBUF_FLAG_POOL) {
                p->len = p->tot_len = PBUF_POOL_BUFSIZE;
                p->payload = (void *)((u8_t *)p + sizeof(struct pbuf));
                PBUF_POOL_FREE(p);
                /* a RAM/ROM referencing pbuf */
            } else if (p->flags == PBUF_FLAG_ROM || p->flags ==
PBUF_FLAG_REF) {
                memp_freep(MEMP_PBUF, p);
                /* pbuf with data */
            } else {
                mem_free(p);
            }
            count++;
            /* proceed to next pbuf */
gko->         if( q != NULL ) q->ref--;
            p = q;
            /* p->ref > 0, this pbuf is still referenced to */
            /* (so the remaining pbufs in chain as well)    */
        } else {
            /* stop walking through chain */
            p = NULL;
        }
    }


Please comment.

-- Guido Konrad