Re: [lwip-users] The sockets interface, select()

[Kieran Mansley]

On Tue, 2011-09-20 at 16:58 +0300, Matias Mandell wrote:
> In short, the lwip_select()-function's local variable
>      struct lwip_select_cb select_cb;
> is also used within the event_callback()-function.
> 
> I do not get a crash if I:
> - exit the event_callback()-loop upon "sock->select_waiting==0", see 
> attached excerpt.
> or
> - create static memory for the select_cb:s.

This sounds like a bug, but I'm not sure if it's in your port or in
lwIP.  lwip_select() looks to be structured so that it will remove the
local select_cb from the list processed by the event callback before it
returns, and it protects itself against concurrent access by the
callback using the SYS_ARCH_PROTECT macros.  What worries me is the case
where SYS_LIGHTWEIGHT_PROT=0 (so the SYS_ARCH_PROTECT code isn't used)
and the event_callback is called in a different context to the
application thread calling select().  In that situation I can see that
it could go wrong: application thread calling select could delete the
select_cb state, while event_callback was in the middle of using it.  I
think the SYS_ARCH_PROTECT macros aren't sufficient protection in this
case.

Kieran