Threaded close of a socket with an accept call active.

[Chris Johns]

A listen socket is open and a thread blocked in the accept call. Closing the socket should result in an error code being passed back to the accept caller(ENXIO seems ok).

Closing a socket with a thread blocked in soconnsleep results in the blocked thread waking. As the thread closing the socket holds the network semaphore, the woken thread either does not get a look in or tries to obtain the network semaphore and blocks. The closing thread finishes freeing the socket structure back to the heap and releasing the network semaphore. The blocked thread gets a go, and then updates the socket structure which causes problems as the memory is now back in the heap.

The code flow. First the accept thread:

rtems/rtems_syscall.c:accept:

head->so_error = soconnsleep (head);

pointer that has been deleted.

Now the close thread:

rtems/rtems_syscall.c:rtems_bsdnet_close:

error = soclose (so);

kern/uipc_socket.c:soclose:

int error2 = (*so->so_proto->pr_usrreqs->pru_detach)(so);

netinet/tcp_usrreq.c:tcp_usr_detach:

tp = tcp_close(tp);

netinet/tcp_subr.c:tcp_close:

soisdisconnected(so);

kern/uipc_socket2.c:soisdisconnecting:

so->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
so->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE);
soconnwakeup(so);
sowwakeup(so);
sorwakeup(so);

kern/uipc_socket.c:soclose:

sofree(so);

I have not followed each syscall path to see what happens in each case (read/write/connect/...).

Release:
CVS

Environment:
Coldfire (Microcore).

How-To-Repeat:
Open a socket, block on accept, close the socket from another thread.

[Chris Johns]

net-close-4-7.diff

[Chris Johns]

net-close-4-6-branch.diff

[Chris Johns]

Updated 4.7 patch for 4.10

[Chris Johns]

Move to 4.11. I will commit after 4.10 branches.

[Joel Sherrill]

Chris. Did you commit the fix for this? If so, please close this. I can't tell.

[Gedare Bloom]

4.10 and 4.11 have not been patched as far as I can tell. Bumping priority since the patch for 4.10 at least seems available.

[Sebastian Huber]

The patch covers only the accept() case, but there are other users of sbwait() and sbconnsleep(). The patch includes unrelated comments. The usage of SS_ASYNC is an obfuscation. Why not simply return an error (e.g. ENXIO) in case a socket got deleted during the wait for event? A test case is missing.

[Sebastian Huber <sebastian.huber@…>]

In f87ede57a2e97f0743a85b94072c7163fa485ae9/rtems:

libnetworking: Fix close of active sockets

Send a special event to notify tasks waiting for a socket state change
in case this socket gets closed. This prevents a use after free.

Close #785.