[lwip-users] [PATCH] Semaphore race condition in api_lib.c

[David Caldwell]

Hello,

 We are using lwip on our embedded device using IP over 1394 as the 
transport. We got it up and running pretty quickly. I'm impressed so far.

 While porting lwip we found a race condition in api_lib.c. What happens 
is a task calls lwip_write() which ends up in netconn_write(). Then a new 
packet comes in on an interrupt right in between the call to sys_sem_free() 
and conn->sem = NULL at the end netconn_write(). The interrupt calls 
tcpip_input() which transfers control to its own task (which is higher 
priority than the task that was in lwip_write(). The tcpip task ends up in 
sent_tcp() where it checks for the connection semaphore == NULL and then 
signals it. This ends up signaling on a semaphore that has been deleted. 
The attached patch fixes the problem for me.

 I don't understand the whole flow of lwip yet so I'm not sure if calling 
lwip_write on a separate task is ok or not. If not, how should it be done?

Thanks,
 David

Index: src/api/api_lib.c
===================================================================
RCS file: /cvs/firmware/gem/firmware/net/lwip/src/api/api_lib.c,v
retrieving revision 1.1.1.2
retrieving revision 1.4
diff -p -u -d -r1.1.1.2 -r1.4
--- a/src/api/api_lib.c 12 May 2004 03:19:07 -0000      1.1.1.2
+++ b/src/api/api_lib.c 12 May 2004 03:25:00 -0000      1.4
@@ -685,8 +685,9 @@ netconn_write(struct netconn *conn, void
  memp_free(MEMP_API_MSG, msg);
  conn->state = NETCONN_NONE;
  if (conn->sem != SYS_SEM_NULL) {
-    sys_sem_free(conn->sem);
+    sys_sem_t sem = conn->sem;
    conn->sem = SYS_SEM_NULL;
+    sys_sem_free(sem);
  }
     return conn->err;

pgpJP4CoUeywC.pgp
Description: PGP signature