Re: Re: [lwip-users] Found bug in pbuf.c

[Kieran Mansley]

On Wed, 28 May 2003, Konrad, Guido wrote:
> I am not sure but please think about the following:
>
> Two pbufs are allocated and chained together with pbuf_ref(t). After that,

I assume you mean pbuf_chain rather than pbuf_ref there!

> the ref count of the first pbuf is 1, the count of the second is 2. For
> three pbufs, you would see ref count 1, 2, 2.
> Example: tcp_out.c in line 211, if you use netconn_write(... _NOCOPY).
>
> If you now try to free the chained pbuf, the code below decrements the ref
> count of every chain member by one, means that only the first is freed. Do
> you agree?
> Example: tcp_seg_free(next); in tcp_in.c after ACK frees only the first
> pbuf.
>
> Please comment,

I'm inclined to think that there's a bug in pbuf_dechain().  Given that
pbuf_chain() increases the reference count, surely pbuf_dechain() should
decrease it?  Maybe there's a good reason why it doesn't (Leon?) but I
can't think of one right now.

Kieran