[lwip-users] [PATCH] Semaphore race condition in api_lib.c

[David Caldwell]

Hello,

  We are using lwip on our embedded device using IP over 1394 as the
transport. We got it up and running pretty quickly. I'm impressed so far.

  While porting lwip we found a race condition in api_lib.c. What happens is
a task calls lwip_write() which ends up in netconn_write(). Then a new
packet comes in on an interrupt right in between the call to sys_sem_free()
and conn->sem = NULL at the end netconn_write(). The interrupt calls
tcpip_input() which transfers control to its own task (which is higher
priority than the task that was in lwip_write(). The tcpip task ends up in
sent_tcp() where it checks for the connection semaphore == NULL and then
signals it. This ends up signaling on a semaphore that has been deleted. The
attached patch fixes the problem for me.

  I don't understand the whole flow of lwip yet so I'm not sure if calling
lwip_write on a separate task is ok or not. If not, how should it be done?

Thanks,
  David


Index: src/api/api_lib.c
===================================================================
RCS file: /cvs/firmware/gem/firmware/net/lwip/src/api/api_lib.c,v
retrieving revision 1.1.1.2
retrieving revision 1.4
diff -p -u -d -r1.1.1.2 -r1.4
--- src/api/api_lib.c   12 May 2004 03:19:07 -0000      1.1.1.2
+++ src/api/api_lib.c   12 May 2004 03:25:00 -0000      1.4
@@ -685,8 +685,9 @@ netconn_write(struct netconn *conn, void
   memp_free(MEMP_API_MSG, msg);
   conn->state = NETCONN_NONE;
   if (conn->sem != SYS_SEM_NULL) {
-    sys_sem_free(conn->sem);
+    sys_sem_t sem = conn->sem;
     conn->sem = SYS_SEM_NULL;
+    sys_sem_free(sem);
   }
   
   return conn->err;

signature.asc
Description: Digital signature