From owner-freebsd-net  Mon Jun  3 12:14:32 2002
Delivered-To: freebsd-net@freebsd.org
Received: from InterJet.dellroad.org (adsl-63-194-81-26.dsl.snfc21.pacbell.net [63.194.81.26])
	by hub.freebsd.org (Postfix) with ESMTP id 213C037B406
	for <freebsd-net@freebsd.org>; Mon,  3 Jun 2002 12:14:26 -0700 (PDT)
Received: from arch20m.dellroad.org (arch20m.dellroad.org [10.1.1.20])
	by InterJet.dellroad.org (8.9.1a/8.9.1) with ESMTP id MAA79988;
	Mon, 3 Jun 2002 12:14:13 -0700 (PDT)
Received: (from archie@localhost)
	by arch20m.dellroad.org (8.11.6/8.11.6) id g53JD7547163;
	Mon, 3 Jun 2002 12:13:07 -0700 (PDT)
	(envelope-from archie)
From: Archie Cobbs <archie@dellroad.org>
Message-Id: <200206031913.g53JD7547163@arch20m.dellroad.org>
Subject: Race condition with M_EXT ref count?
To: freebsd-net@freebsd.org
Date: Mon, 3 Jun 2002 12:13:07 -0700 (PDT)
X-Mailer: ELM [version 2.4ME+ PL88 (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-net.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-net>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-net>
X-Loop: FreeBSD.org

This is a question about M_EXT mbuf reference counts in FreeBSD-stable.

There are several instances in kern/uipc_mbuf.c that add a reference
to an M_EXT mbuf by either incrementing the entry in the mclrefcnt[]
array or invoking the "custom" ext_ref routine.

However, it seems that these instances are all broken because they
don't wrap these operations within splimp()...

Isn't the following C statement *not* atomic?

	mclrefcnt[mtocl(m->m_ext.ext_buf)]++;

And isn't access to mclrefcnt[] supposed to be protected by splimp()?
Note: MCLFREE() *does* set splimp() before decrementing M_EXT ref counts.

Therefore, isn't there a race condition wrt. the M_EXT reference counts?

The functions which fail to set splimp() before adding a reference are:

	m_copym()
	m_copypacket()
	m_split()

Thanks for any comments/clarification on this subject..

-Archie

__________________________________________________________________________
Archie Cobbs     *     Packet Design     *     http://www.packetdesign.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message