Re: [ECOS] uipc_socket.c (and cyg_tcp_maxidle)

[Andrew Lunn <andrew@lunn.ch>]

[-- Attachment #1: Type: text/plain, Size: 1297 bytes --]

On Thu, Jun 16, 2005 at 09:01:23AM +0200, Hans H?bner wrote:
> On Wed, 15 Jun 2005, Will Lentz wrote:
> 
> >I may have found a potential bug in
> >packages/net/bsd_tcpip/current/src/sys/kern/uipc_socket.c (or I may be
> >completely wrong :-).
> >
> >At the end of sodealloc(), the following code exists:
> >      zfreei(so->so_zone, so);
> >      wakeup(so->so_zone);
> >The problem is that zfreei() changes so->so_zone.  Shouldn't wakeup() be
> >done on the original so->so_zone?  I only noticed this problem by:
> >1- while(1) {
> >  sock = socket( AF_INET, SOCK_STREAM, IPPROTO_TCP );
> >  connect( sock, ... );
> >  close( sock );
> >  }
> >  Eventually this pauses in socket() (in cyg_tsleep()) when you run out
> >of eCos sockets.
> >
> >2- After 2*MSL or so, cyg_wakeup() gets called with chan == 0x0.  Why?
> >The zfreei() call in sodealloc() changes so->so_zone to 0 before the
> >wakeup() call.

This is not quite correct. zfreei() does not change so->so_zone. What
it does is return the memory for the so structure to the pool. The
wakeup then uses the memory which has just been returned to the
pool. There is a race condition. Once back into the pool the memory
could be allocated to another thread before the call to wakeup is
made.

Attached is a patch to fix this.

        Andrew

[-- Attachment #2: sodealloc.diff --]
[-- Type: text/plain, Size: 1495 bytes --]

Index: net/bsd_tcpip/current/ChangeLog
===================================================================
RCS file: /cvs/ecos/ecos-opt/net/net/bsd_tcpip/current/ChangeLog,v
retrieving revision 1.52
diff -u -r1.52 ChangeLog
--- net/bsd_tcpip/current/ChangeLog	27 Mar 2005 18:18:13 -0000	1.52
+++ net/bsd_tcpip/current/ChangeLog	17 Jun 2005 20:08:29 -0000
@@ -1,3 +1,8 @@
+2005-06-17  Andrew Lunn  <andrew.lunn@ascom.ch>
+
+	* src/sys/kern/uipc_socket.c (sodealloc): Fixed a race condition
+	when freeing the socket memory. Problem reported by Will Lent.
+
 2005-03-27  Andrew Lunn  <andrew.lunn@ascom.ch>
 
 	* src/sys/net/if.c (ifioctl): Fixed a compiler warning about 
Index: net/bsd_tcpip/current/src/sys/kern/uipc_socket.c
===================================================================
RCS file: /cvs/ecos/ecos-opt/net/net/bsd_tcpip/current/src/sys/kern/uipc_socket.c,v
retrieving revision 1.3
diff -u -r1.3 uipc_socket.c
--- net/bsd_tcpip/current/src/sys/kern/uipc_socket.c	24 Jul 2003 18:04:25 -0000	1.3
+++ net/bsd_tcpip/current/src/sys/kern/uipc_socket.c	17 Jun 2005 20:08:31 -0000
@@ -188,8 +188,10 @@
 void
 sodealloc(so)
 	struct socket *so;
+        
 {
-
+        vm_zone_t zone;
+  
 	so->so_gencnt = ++so_gencnt;
 #ifdef INET
 	if (so->so_accf != NULL) {
@@ -202,8 +204,9 @@
 		FREE(so->so_accf, M_ACCF);
 	}
 #endif /* INET */
-	zfreei(so->so_zone, so);
-        wakeup(so->so_zone);
+        zone = so->so_zone;
+        zfreei(zone, so);
+        wakeup(zone);
 }
 
 int


[-- Attachment #3: Type: text/plain, Size: 148 bytes --]

-- 
Before posting, please read the FAQ: http://ecos.sourceware.org/fom/ecos
and search the list archive: http://ecos.sourceware.org/ml/ecos-discuss