Comments (2)
I have reproduced the same exact issue in a test suite with Gstreamers usrsctplib version, in my case the sctp-timer thread ticks with a SCTP_TIMER_TYPE_SHUTDOWN
event, decrements a reference on the socket and eventually calls sofree() which triggers this same assert:
KASSERT(so->so_count == 0, ("sodealloc(): so_count %d", so->so_count));
@tuexen is there anything else we can help you with to figure out this issue?
I can reproduce it very often with a test that stresses the setup and shutdown of the sockets, so it won't be a problem to dig out more information.
from usrsctp.
@tuexen : I have a hypothesis here.
The userspace code in sctp_close
locks SCTP_INP_WLOCK
when it sets SCTP_PCB_FLAGS_SOCKET_GONE
in sctp_flags
; however, the userspace code to set upcall_socket
in sctp_timeout_handler
checks that bit in sctp_flags
without, as far as I can tell, acquiring that lock. Thus, I suspect, under load, the sctp_timeout_handler
thread can get suspended immediately after the check of SCTP_PCB_FLAGS_SOCKET_GONE
, and a usrsctp_close
call can sneak in.
However, I don't understand the lock hierarchy here. Would it be safe to lock SCTP_INP in sctp_timeout_handler
, or could that cause a lock inversion?
from usrsctp.
Related Issues (20)
- CVE-2022-46871 impact on libusrsctp HOT 1
- Aborted with sctp_timeout_handler: tmr->self corrupted, but tmr->self is null in the core dump HOT 6
- Broken build on macOS 13.4 (apple sillicon) HOT 1
- What does usrsctp_conninput do? HOT 1
- [question] What's the release policy? HOT 2
- -Wunused-function atomic_init
- Question about the different streams in the same association HOT 2
- New release? HOT 2
- disabling sctp chunk bundling HOT 3
- user_environment.c: extra "{" in read_random()
- Q: Support for L4S HOT 1
- if usrsctp support android
- sctp over udp encapsulation does not work under NAT network : part 2 HOT 1
- Is it possiable adding BBR Congestion Control algorithm for usrsctp? HOT 1
- Crash in sctp_common_input_processing: race between usrsctp_conninput and usrsctp_accept HOT 1
- Reproducer: soref of deleted socket
- Deadlock between usrsctp_conninput and usrsctp_close HOT 1
- Self-deadlock in usrsctp_close while recv_callback is being invoked HOT 1
- sctp_pcb_finish does not destroy sctp_it_ctl.it_mtx if __Userspace__ is true
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from usrsctp.