Date: Tue, 12 Dec 2000 01:51:00 -0800 From: Alfred Perlstein <bright@wintelcom.net> To: Bosko Milekic <bmilekic@technokratis.com> Cc: net@FreeBSD.ORG, jhb@FreeBSD.ORG, jasone@FreeBSD.ORG Subject: Re: MEXT_IS_REF broken. Message-ID: <20001212015059.Z16205@fw.wintelcom.net> In-Reply-To: <20001212014429.Y16205@fw.wintelcom.net>; from bright@wintelcom.net on Tue, Dec 12, 2000 at 01:44:30AM -0800 References: <20001211014837.W16205@fw.wintelcom.net> <Pine.BSF.4.21.0012111223350.21769-100000@jehovah.technokratis.com> <20001212014429.Y16205@fw.wintelcom.net>
next in thread | previous in thread | raw e-mail | index | archive | help
* Alfred Perlstein <bright@wintelcom.net> [001212 01:44] wrote: > grr... > > considering this: > > #define MEXT_IS_REF(m) ((m)->m_ext.ref_cnt->refcnt > 1) > > #define MEXT_REM_REF(m) do { \ > KASSERT((m)->m_ext.ref_cnt->refcnt > 0, ("m_ext refcnt < 0")); \ > atomic_subtract_long(&((m)->m_ext.ref_cnt->refcnt), 1); \ > } while(0) > > this: > > #define MEXTFREE(m) do { \ > struct mbuf *_mmm = (m); \ > \ > if (MEXT_IS_REF(_mmm)) \ > MEXT_REM_REF(_mmm); \ > > > is not mpsafe. we _NEED_ some type that allows atomic dec and test > for 0. Sorry, I didn't explain why this is broken, it looks safe because if it's 1 then only "we" reference it. This is incorrect: (m)->m_ext.ref_cnt->refcnt == 2 thread a thread b if (MEXT_IS_REF(m)) if (MEXT_IS_REF(m)) MEXT_REM_REF(m); MEXT_REM_REF(m); now... (m)->m_ext.ref_cnt->refcnt == 0. oops, now the destructor never gets called and we just leaked a mbuf cluster. -- -Alfred Perlstein - [bright@wintelcom.net|alfred@freebsd.org] "I have the heart of a child; I keep it in a jar on my desk." To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001212015059.Z16205>