[lwip-devel] [bug #52719] sys_timeouts synchronization issue with core locking (NO_SYS == 0)

[Joel Cunningham]

URL:
  <http://savannah.nongnu.org/bugs/?52719>

                 Summary: sys_timeouts synchronization issue with core locking
(NO_SYS == 0)
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: jcunningham
            Submitted on: Thu 21 Dec 2017 09:50:59 PM UTC
                Category: None
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

I've found a synchronization issue with sys_timeouts and core locking for
NO_SYS == 0. This was found during code inspection.

The TCP/IP thread calls sys_timeouts_mbox_fetch() with the core lock
explicitly released.  Within this function, next_timeout is read/modified in
sys_timeouts_sleeptime and sys_check_timeouts.

Since sys_timeout/untimeout also read/modify next_timeout, this can only be
safely called from the TCP/IP thread.  I believe I've found instances with
core locking where sys_timeout/untimeout will be called on another thread.

The macro TCP_REG will be executed in a number of cases from other threads and
it calls tcp_timer_needed().  If tcpip_tcp_timer_active is 0 and
tcp_active_pcbs or tcp_tw_pcbs are non-NULL, sys_timeout will be called to
start the TCP timer.

In one of my test environments, I put a breakpoint on when this particular
sys_timeout is called and I found an application thread inside lwip_connect()
which triggered it

I also see a lot of calls to sys_timeout in PPP code, which may also be
executed on another thread with core locking (I'm not that familiar with the
PPP architecture though)








    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?52719>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/