[lwip-devel] Possibly bug.

[Vadim Melihow]

Have 2 threads. - tcp/ip thread & tcp read thread.

Use CVS head & socket API

it look like lwip bug, but Im not sure. Please fix me if I mistaken

Thanks.

Ok.  I just have segfault sometimes

TCP thread  backtrace - 

------------------------------------

#0  0x08063b10 in sys_mbox_post (mbox=0x0, msg=0x0) at lwip/cvs/contrib/ports/unix/sys_arch.c:372

#1  0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322

#2  0x0808a7d1 in tcp_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/tcp_in.c:313

#3  0x08060db7 in ip_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/ipv4/ip.c:417

#4  0x08061e3c in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:111

#5  0xb7ac81b5 in start_thread () from /lib/libpthread.so.0

#6  0xb7e523ae in clone () from /lib/libc.so.6

(gdb) up

#1  0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322

322         sys_mbox_post(conn->recvmbox, NULL);

(gdb) p *conn

$4 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x899e998, recvmbox = 0x0,

  acceptmbox = 0x0, socket = 2, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 0, write_msg = 0x0, write_offset = 0,

  callback = 0x806e77d <sx3g_event_callback>}

 

READER thread backtrace 

(gdb) bt

#2  0xb7e5eb84 in pthread_cond_timedwait () from /lib/libc.so.6

#3  0x08064138 in cond_wait (cond=0x89db07c, mutex=0x89db0ac, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:617

#4  0x08064223 in sys_arch_sem_wait (sem=0x89db078, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:650

#5  0x08063d58 in sys_arch_mbox_fetch (mbox=0x8abb148, msg=0xb4f04298, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:476

#6  0x0808efe3 in netconn_drain (conn=0x826216c, bytes_drained=0xb4f042d0, accepts_drained=0xb4f042ce) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:624

#7  0x0808dec7 in netconn_delete (conn=0x826216c) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114

#8  0x0806bcb0 in lwip_close (s=2) at  sockets.c:421

#9  0x0806a14f in tcp_read_thread (arg=0x8836328) at tcp_handlers.c:408

#10 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0

#11 0xb7e523ae in clone () from /lib/libc.so.6

Situation -  

- we got RST from remote side

- tcp/ip thread call err_tcp 

@api_msg.c line 319

  if (conn->recvmbox != SYS_MBOX_NULL) {

    /* Register event with callback */

    API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0);

    sys_mbox_post(conn->recvmbox, NULL);

  }

-  After   API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0); TCP read thread got  waked  and start trying read from socket and cause lwip_read returned - 0 bytes - trying to close socket

- First all lwip_close call netconn_delete -> netconn_drain 

netconn_drain set recvmbox to SYS_MBOX_NULL and after switch context to tcp/ip thread we got segfault at sys_mbox_post(conn->recvmbox, NULL);  cause recvmbox = NULL

  Plsease fix me if I wrong.