Thu 14 Jan 2010 03:43:47 PM UTC, comment #8:
I think the cause rather might be 'conn->pcb.tcp = NULL;' in err_tcp(), because the one in netconn_delete() is executed after do_delconn() (which in turn executes netconn_drain()).
Anyway, I didn't think the pcb might be null here, which it can (due to err_tcp), so I've included an if(!=NULL) around the calls, which should solve the problem.
|
Thu 14 Jan 2010 03:35:42 PM UTC, comment #7:
little more info
TCP thread
[Switching to thread 1 (Thread 28899)]#0 0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
447 pcb->rcv_wnd += len;
(gdb) bt
#0 0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
#1 0x0808f003 in netconn_drain (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
#2 0x0808f266 in do_delconn (msg=0xb4e7a388) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:712
#3 0x08061dfa in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:100
(gdb) up
#1 0x0808f003 in netconn_drain (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
622 tcp_recved(conn->pcb.tcp, p->tot_len);
(gdb) p *conn
$2 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x89a7108, recvmbox = 0x0,
acceptmbox = 0x0, socket = 9, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 438, write_msg = 0x0, write_offset = 0,
callback = 0x806e691 <sx3g_event_callback>}
TCP READ_THREAD
----------------------------------
(gdb) bt
#0 0xb7f09410 in ?? ()
#1 0x0806413d in cond_wait (cond=0x89a710c, mutex=0x89a713c, timeout=0) at lwip/cvs/contrib/ports/unix/sys_arch.c:635
#2 0x080641cf in sys_arch_sem_wait (sem=0x89a7108, timeout=0) at lwip/cvs/contrib/ports/unix/sys_arch.c:662
#3 0x08062157 in tcpip_apimsg (apimsg=0xb4e7a384) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:289
#4 0x0808df6e in netconn_delete (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#5 0x0806bbc4 in lwip_socket_close (s=9) at sockets.c:421
#6 0x0806a063 in tcp_read_thread (arg=0x88360e8) at tcp_handlers.c:408
Possibly cause
conn->pcb.tcp = NULL; at netconn_delete @ api_lib.c
|
Tue 12 Jan 2010 11:47:47 AM UTC, original submission:
Have 2 threads. - tcp/ip thread & tcp read thread.
it look like lwip bug, but Im not sure. Please fix me if I mistaken
Thanks.
Ok. I just have segfault sometimes
TCP thread backtrace -
------------------------------------
#0 0x08063b10 in sys_mbox_post (mbox=0x0, msg=0x0) at lwip/cvs/contrib/ports/unix/sys_arch.c:372
#1 0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
#2 0x0808a7d1 in tcp_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/tcp_in.c:313
#3 0x08060db7 in ip_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/ipv4/ip.c:417
#4 0x08061e3c in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:111
#5 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#6 0xb7e523ae in clone () from /lib/libc.so.6
(gdb) up
#1 0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
322 sys_mbox_post(conn->recvmbox, NULL);
(gdb) p *conn
$4 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x899e998, recvmbox = 0x0,
acceptmbox = 0x0, socket = 2, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 0, write_msg = 0x0, write_offset = 0,
callback = 0x806e77d <sx3g_event_callback>}
READER thread backtrace
(gdb) bt
#2 0xb7e5eb84 in pthread_cond_timedwait () from /lib/libc.so.6
#3 0x08064138 in cond_wait (cond=0x89db07c, mutex=0x89db0ac, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:617
#4 0x08064223 in sys_arch_sem_wait (sem=0x89db078, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:650
#5 0x08063d58 in sys_arch_mbox_fetch (mbox=0x8abb148, msg=0xb4f04298, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:476
#6 0x0808efe3 in netconn_drain (conn=0x826216c, bytes_drained=0xb4f042d0, accepts_drained=0xb4f042ce) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:624
#7 0x0808dec7 in netconn_delete (conn=0x826216c) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#8 0x0806bcb0 in lwip_close (s=2) at sockets.c:421
#9 0x0806a14f in tcp_read_thread (arg=0x8836328) at tcp_handlers.c:408
#10 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#11 0xb7e523ae in clone () from /lib/libc.so.6
Situation -
- we got RST from remote side
- tcp/ip thread call err_tcp
@api_msg.c line 319
if (conn->recvmbox != SYS_MBOX_NULL) {
/* Register event with callback */
API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0);
sys_mbox_post(conn->recvmbox, NULL);
}
- After API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0); TCP read thread got waked and start trying read from socket and cause lwip_read returned - 0 bytes - trying to close socket
- First all lwip_close call netconn_delete -> netconn_drain
netconn_drain set recvmbox to SYS_MBOX_NULL and after switch context to tcp/ip thread we got segfault at sys_mbox_post(conn->recvmbox, NULL); cause recvmbox = NULL
Plsease fix me if I wrong.
|