Date: Tue, 12 Dec 2000 01:51:00 -0800 From: Alfred Perlstein <bright@wintelcom.net> To: Bosko Milekic <bmilekic@technokratis.com> Cc: net@FreeBSD.ORG, jhb@FreeBSD.ORG, jasone@FreeBSD.ORG Subject: Re: MEXT_IS_REF broken. Message-ID: <20001212015059.Z16205@fw.wintelcom.net> In-Reply-To: <20001212014429.Y16205@fw.wintelcom.net>; from bright@wintelcom.net on Tue, Dec 12, 2000 at 01:44:30AM -0800 References: <20001211014837.W16205@fw.wintelcom.net> <Pine.BSF.4.21.0012111223350.21769-100000@jehovah.technokratis.com> <20001212014429.Y16205@fw.wintelcom.net>
next in thread | previous in thread | raw e-mail | index | archive | help
* Alfred Perlstein <bright@wintelcom.net> [001212 01:44] wrote:
> grr...
>
> considering this:
>
> #define MEXT_IS_REF(m) ((m)->m_ext.ref_cnt->refcnt > 1)
>
> #define MEXT_REM_REF(m) do { \
> KASSERT((m)->m_ext.ref_cnt->refcnt > 0, ("m_ext refcnt < 0")); \
> atomic_subtract_long(&((m)->m_ext.ref_cnt->refcnt), 1); \
> } while(0)
>
> this:
>
> #define MEXTFREE(m) do { \
> struct mbuf *_mmm = (m); \
> \
> if (MEXT_IS_REF(_mmm)) \
> MEXT_REM_REF(_mmm); \
>
>
> is not mpsafe. we _NEED_ some type that allows atomic dec and test
> for 0.
Sorry, I didn't explain why this is broken, it looks safe because
if it's 1 then only "we" reference it. This is incorrect:
(m)->m_ext.ref_cnt->refcnt == 2
thread a thread b
if (MEXT_IS_REF(m))
if (MEXT_IS_REF(m))
MEXT_REM_REF(m);
MEXT_REM_REF(m);
now... (m)->m_ext.ref_cnt->refcnt == 0.
oops, now the destructor never gets called and we just leaked a
mbuf cluster.
--
-Alfred Perlstein - [bright@wintelcom.net|alfred@freebsd.org]
"I have the heart of a child; I keep it in a jar on my desk."
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001212015059.Z16205>