[lwip-users] Bug in pbuf.c regarding PBUF_POOL

[Goldschmidt Simon]

Hi all,

I was experiencing problems with pbufs of type PBUF_POOL which did seem
very odd (ref-counts were wrong, payload was set back to start of
buffer...). Now, I used some old version (1.1.0 I think), where those
problems did not occur. After diff'ing those two versions, I found that
pbuf_pool_alloc uses a new locking scheme which, to me, seems totally
buggy!

On allocating a PBUF_POOL, pbuf_pool_alloc() locks the pool by setting a
variable to 1 (not thread-safe!!!), but when freeing a PBUF_POOL,
PBUF_POOL_FREE() still locks the pool the old way using a semaphore. So
there are two locks! They prevent running pbuf_pool_alloc() twice at the
same time or running PBUF_POOL_FREE() twice, but they don't gain
exclusive access to the pool!

Though this is only relevant if SYS_LIGHTWEIGHT_PROT is set to 0, but
that was the case with me...
Setting SYS_LIGHTWEIGHT_PROT made the problem disappear.

Hope for some comments on this...


Simon