Opened 15 years ago

Last modified 15 years ago

#913 closed defect

Concurrency problem in select ioqueue may corrupt descriptor set — at Version 1

Reported by: bennylp Owned by: bennylp
Priority: major Milestone: release-1.4
Component: pjlib Version: trunk
Keywords: Cc:
Backport to 1.x milestone: Backported:

Description (last modified by bennylp)

If one thread is unregistering the socket while another is issuing pending operation such as recv or send, this may corrupt the descriptor set in the ioqueue, causing subsequent select() inside pj_ioqueue_poll() to return error.

Detailed scenario:

  • thread A issues pj_ioqueue_recv(), and midway it is interrupted by thread B
  • thread B issues pj_ioqueue_unregister(sock) which closes the socket.
  • thread A resumes execution, ultimately gaining the key's mutex. But it does not check if the key has been unregistered. It adds the socket handle (which has been closed by thread B) to the read descriptor set.
  • subsequent select() will return -1 since it contains invalid handle

This will cause the ioqueue to stop receiving events.

Change History (1)

comment:1 Changed 15 years ago by bennylp

  • Description modified (diff)
  • Priority changed from normal to major
  • Summary changed from Concurrency problem in ioqueue to Concurrency problem in select ioqueue may corrupt descriptor set
Note: See TracTickets for help on using tickets.