Changeset 2826

Timestamp:

Jul 2, 2009 8:24:22 AM (15 years ago)

Author:

bennylp

Message:

Ticket #913: Concurrency problem in select ioqueue may corrupt descriptor set

• fixed the concurrency problem
• also fixed ioqueue unregister test in pjlib-test

Location:

pjproject/trunk/pjlib/src

Files:

• pj/ioqueue_common_abs.c (modified) (6 diffs)
• pjlib-test/ioq_unreg.c (modified) (10 diffs)

pjproject/trunk/pjlib/src/pj/ioqueue_common_abs.c

@@ -688 +688 @@
 
     pj_mutex_lock(key->mutex);
+    /* Check again. Handle may have been closed after the previous check
+     * in multithreaded app. If we add bad handle to the set it will
+     * corrupt the ioqueue set. See #913
+     */
+    if (IS_CLOSING(key)) {
+        pj_mutex_unlock(key->mutex);
+        return PJ_ECANCELLED;
+    }
     pj_list_insert_before(&key->read_list, read_op);
     ioqueue_add_to_set(key->ioqueue, key, READABLE_EVENT);
@@ -756 +764 @@
 
     pj_mutex_lock(key->mutex);
+    /* Check again. Handle may have been closed after the previous check
+     * in multithreaded app. If we add bad handle to the set it will
+     * corrupt the ioqueue set. See #913
+     */
+    if (IS_CLOSING(key)) {
+        pj_mutex_unlock(key->mutex);
+        return PJ_ECANCELLED;
+    }
     pj_list_insert_before(&key->read_list, read_op);
     ioqueue_add_to_set(key->ioqueue, key, READABLE_EVENT);
@@ -862 +878 @@
     
     pj_mutex_lock(key->mutex);
+    /* Check again. Handle may have been closed after the previous check
+     * in multithreaded app. If we add bad handle to the set it will
+     * corrupt the ioqueue set. See #913
+     */
+    if (IS_CLOSING(key)) {
+        pj_mutex_unlock(key->mutex);
+        return PJ_ECANCELLED;
+    }
     pj_list_insert_before(&key->write_list, write_op);
     ioqueue_add_to_set(key->ioqueue, key, WRITEABLE_EVENT);
@@ -979 +1003 @@
     
     pj_mutex_lock(key->mutex);
+    /* Check again. Handle may have been closed after the previous check
+     * in multithreaded app. If we add bad handle to the set it will
+     * corrupt the ioqueue set. See #913
+     */
+    if (IS_CLOSING(key)) {
+        pj_mutex_unlock(key->mutex);
+        return PJ_ECANCELLED;
+    }
     pj_list_insert_before(&key->write_list, write_op);
     ioqueue_add_to_set(key->ioqueue, key, WRITEABLE_EVENT);
@@ -1048 +1080 @@
 
     pj_mutex_lock(key->mutex);
+    /* Check again. Handle may have been closed after the previous check
+     * in multithreaded app. If we add bad handle to the set it will
+     * corrupt the ioqueue set. See #913
+     */
+    if (IS_CLOSING(key)) {
+        pj_mutex_unlock(key->mutex);
+        return PJ_ECANCELLED;
+    }
     pj_list_insert_before(&key->accept_list, accept_op);
     ioqueue_add_to_set(key->ioqueue, key, READABLE_EVENT);
@@ -1084 +1124 @@
             /* Pending! */
             pj_mutex_lock(key->mutex);
+            /* Check again. Handle may have been closed after the previous 
+             * check in multithreaded app. See #913
+             */
+            if (IS_CLOSING(key)) {
+                pj_mutex_unlock(key->mutex);
+                return PJ_ECANCELLED;
+            }
             key->connecting = PJ_TRUE;
             ioqueue_add_to_set(key->ioqueue, key, WRITEABLE_EVENT);

pjproject/trunk/pjlib/src/pjlib-test/ioq_unreg.c

@@ -94 +94 @@
             sock_data.unregistered = 1;
             pj_ioqueue_unregister(key);
-            pj_mutex_destroy(sock_data.mutex);
-            pj_pool_release(sock_data.pool);
-            sock_data.pool = NULL;
             return;
         }
@@ -244 +241 @@
     for (;;) {
         pj_time_val now, timeout;
+        int n;
 
         pj_gettimeofday(&now);
@@ -249 +247 @@
         if (test_method == UNREGISTER_IN_APP && 
             PJ_TIME_VAL_GTE(now, time_to_unregister) &&
-            sock_data.pool) 
+            !sock_data.unregistered) 
         {
-            //Can't do this otherwise it'll deadlock
-            //pj_mutex_lock(sock_data.mutex);
-
             sock_data.unregistered = 1;
+            /* Wait (as much as possible) for callback to complete */
+            pj_mutex_lock(sock_data.mutex);
+            pj_mutex_unlock(sock_data.mutex);
             pj_ioqueue_unregister(sock_data.key);
-            //pj_mutex_unlock(sock_data.mutex);
-            pj_mutex_destroy(sock_data.mutex);
-            pj_pool_release(sock_data.pool);
-            sock_data.pool = NULL;
         }
 
@@ -266 +260 @@
 
         timeout.sec = 0; timeout.msec = 10;
-        pj_ioqueue_poll(ioqueue, &timeout);
-        //pj_thread_sleep(1);
-
+        n = pj_ioqueue_poll(ioqueue, &timeout);
+        if (n < 0) {
+            app_perror("pj_ioqueue_poll error", -n);
+            pj_thread_sleep(1);
+        }
     }
 
@@ -277 +273 @@
         pj_thread_destroy(thread[i]);
     }
+
+    /* Destroy data */
+    pj_mutex_destroy(sock_data.mutex);
+    pj_pool_release(sock_data.pool);
+    sock_data.pool = NULL;
 
     if (other_socket) {
@@ -315 +316 @@
     }
 
-    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 0/3 (%s)", 
+    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 0/3, unregister in app (%s)", 
                pj_ioqueue_name()));
     for (i=0; i<LOOP; ++i) {
@@ -325 +326 @@
 
 
-    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 1/3 (%s)",
+    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 1/3, unregister in app (%s)",
                pj_ioqueue_name()));
     for (i=0; i<LOOP; ++i) {
@@ -336 +337 @@
     test_method = UNREGISTER_IN_CALLBACK;
 
-    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 2/3 (%s)", 
+    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 2/3, unregister in cb (%s)", 
                pj_ioqueue_name()));
     for (i=0; i<LOOP; ++i) {
@@ -346 +347 @@
 
 
-    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 3/3 (%s)", 
+    PJ_LOG(3, (THIS_FILE, "...ioqueue unregister stress test 3/3, unregister in cb (%s)", 
                pj_ioqueue_name()));
     for (i=0; i<LOOP; ++i) {
@@ -367 +368 @@
     rc = udp_ioqueue_unreg_test_imp(PJ_TRUE);
     if (rc != 0)
-        return rc;
+        return rc;
 
     rc = udp_ioqueue_unreg_test_imp(PJ_FALSE);