From owner-freebsd-net  Tue Dec 12  1:51: 4 2000
From owner-freebsd-net@FreeBSD.ORG  Tue Dec 12 01:51:02 2000
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from fw.wintelcom.net (ns1.wintelcom.net [209.1.153.20])
	by hub.freebsd.org (Postfix) with ESMTP
	id F27D137B400; Tue, 12 Dec 2000 01:51:01 -0800 (PST)
Received: (from bright@localhost)
	by fw.wintelcom.net (8.10.0/8.10.0) id eBC9p0Q03858;
	Tue, 12 Dec 2000 01:51:00 -0800 (PST)
Date: Tue, 12 Dec 2000 01:51:00 -0800
From: Alfred Perlstein <bright@wintelcom.net>
To: Bosko Milekic <bmilekic@technokratis.com>
Cc: net@FreeBSD.ORG, jhb@FreeBSD.ORG, jasone@FreeBSD.ORG
Subject: Re: MEXT_IS_REF broken.
Message-ID: <20001212015059.Z16205@fw.wintelcom.net>
References: <20001211014837.W16205@fw.wintelcom.net> <Pine.BSF.4.21.0012111223350.21769-100000@jehovah.technokratis.com> <20001212014429.Y16205@fw.wintelcom.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20001212014429.Y16205@fw.wintelcom.net>; from bright@wintelcom.net on Tue, Dec 12, 2000 at 01:44:30AM -0800
Sender: bright@fw.wintelcom.net
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

* Alfred Perlstein <bright@wintelcom.net> [001212 01:44] wrote:
> grr...
> 
> considering this:
> 
> #define MEXT_IS_REF(m) ((m)->m_ext.ref_cnt->refcnt > 1)
> 
> #define MEXT_REM_REF(m) do {                        \
>     KASSERT((m)->m_ext.ref_cnt->refcnt > 0, ("m_ext refcnt < 0"));  \
>     atomic_subtract_long(&((m)->m_ext.ref_cnt->refcnt), 1);     \
> } while(0)
> 
> this:
> 
> #define MEXTFREE(m) do {                        \
>     struct mbuf *_mmm = (m);                    \
>                                     \
>     if (MEXT_IS_REF(_mmm))                      \
>         MEXT_REM_REF(_mmm);                 \
> 
>  
> is not mpsafe.  we _NEED_ some type that allows atomic dec and test
> for 0.

Sorry, I didn't explain why this is broken, it looks safe because
if it's 1 then only "we" reference it.  This is incorrect:

(m)->m_ext.ref_cnt->refcnt == 2

thread a                       thread b

if (MEXT_IS_REF(m))
                               if (MEXT_IS_REF(m))
  MEXT_REM_REF(m);
                                  MEXT_REM_REF(m);

now... (m)->m_ext.ref_cnt->refcnt == 0.

oops, now the destructor never gets called and we just leaked a
mbuf cluster.

-- 
-Alfred Perlstein - [bright@wintelcom.net|alfred@freebsd.org]
"I have the heart of a child; I keep it in a jar on my desk."


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message