Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 3 Jun 2002 12:25:52 -0700 (PDT)
From:      Julian Elischer <julian@elischer.org>
To:        Archie Cobbs <archie@dellroad.org>
Cc:        freebsd-net@freebsd.org, smp@freebsd.org
Subject:   Re: Race condition with M_EXT ref count?
Message-ID:  <Pine.BSF.4.21.0206031225070.43219-100000@InterJet.elischer.org>
In-Reply-To: <200206031913.g53JD7547163@arch20m.dellroad.org>

next in thread | previous in thread | raw e-mail | index | archive | help
this is YET ANOTHER case for the Atomic reference counting ABI that
jhb has been talking about...


On Mon, 3 Jun 2002, Archie Cobbs wrote:

> This is a question about M_EXT mbuf reference counts in FreeBSD-stable.
> 
> There are several instances in kern/uipc_mbuf.c that add a reference
> to an M_EXT mbuf by either incrementing the entry in the mclrefcnt[]
> array or invoking the "custom" ext_ref routine.
> 
> However, it seems that these instances are all broken because they
> don't wrap these operations within splimp()...
> 
> Isn't the following C statement *not* atomic?
> 
> 	mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
> 
> And isn't access to mclrefcnt[] supposed to be protected by splimp()?
> Note: MCLFREE() *does* set splimp() before decrementing M_EXT ref counts.
> 
> Therefore, isn't there a race condition wrt. the M_EXT reference counts?
> 
> The functions which fail to set splimp() before adding a reference are:
> 
> 	m_copym()
> 	m_copypacket()
> 	m_split()
> 
> Thanks for any comments/clarification on this subject..
> 
> -Archie
> 
> __________________________________________________________________________
> Archie Cobbs     *     Packet Design     *     http://www.packetdesign.com
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-net" in the body of the message
> 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0206031225070.43219-100000>