[lwip-devel] [bug #31741] lwip_select seems to have threading problems

[Simon Goldschmidt]

URL:
  <http://savannah.nongnu.org/bugs/?31741>

                 Summary: lwip_select seems to have threading problems
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: goldsimon
            Submitted on: Do 02 Dez 2010 11:37:30 GMT
                Category: sockets
                Severity: 4 - Important
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 1.4.0
            lwIP version: CVS Head

    _______________________________________________________

Details:

>From lwip-users:

As for the crash I mentioned, it occurs in event_callbacks' select
handling, and is not the result of the above-mentioned threading limitation.

It seems to be the result of changing the synchronization mechanism in
1.4.0. lwIP 1.3.2 used a "broad" semaphore to synchronize event_callback
and lwip_select whereas 1.4.0 rc1 uses the critical section and a counter.

The following code in event_callback crashes when dereferencing scb:


        for (scb = select_cb_list; scb; scb = scb->next) {

We have found the following problems:


1. In the event_callback code:


        /* unlock interrupts with each step */

        last_select_cb_ctr = select_cb_ctr;
        SYS_ARCH_UNPROTECT(lev);
        SYS_ARCH_PROTECT(lev);
        if (last_select_cb_ctr != select_cb_ctr) {
            /* someone has changed select_cb_list, restart at the
beginning */
            scb = select_cb_list;

        }


When someone removes the last element in the list (scb == NULL) we
should break out of the loop.


2. In lwip_select, the counter is not updated when an element is removed
from the list.


        /* Take us off the list */
        SYS_ARCH_PROTECT(lev);
        if (select_cb.next != NULL) {
            select_cb.next->prev = select_cb.prev;
        }
        if (select_cb_list == &select_cb) {
            LWIP_ASSERT("select_cb.prev == NULL", select_cb.prev == NULL);
            select_cb_list = select_cb.next;
        } else {
            LWIP_ASSERT("select_cb.prev != NULL", select_cb.prev != NULL);
            select_cb.prev->next = select_cb.next;
        }
        SYS_ARCH_UNPROTECT(lev);




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?31741>

_______________________________________________
  Nachricht geschickt von/durch Savannah
  http://savannah.nongnu.org/