Problem with rtems_task_variable_delete

[Fernando RUIZ CASAS]

On Tue, 09 Dec 2003 01:18:32 -0800 (PST), "Fernando RUIZ CASAS" wrote:

> 
> On Mon, 08 Dec 2003 22:58:15 +0100, Dieter Schaefer wrote:
> Hi,
> 
>   The same problem ago.
> 
>   A patch has be submitted longtime ago to resolve this concern.
> 
>   The problem is that a new implementation of core has been done.
> 
>   The problem is in 
>   /rtems/cpukit/rtems/src/taskvariabledelete.c
> 
>   at line 59
>    _Workspace_free(tvp) needs be changed by
>    
>    _Workspace_free(*tvp) perhaphs. (I can't test it,sorry)
> 
>   It's a problem resolved but with the new implementation the problem arrives again.
> 
>   A lot of mails have been interchanged with Joel to obtain a patch in the core.
>   
>   BRGDS. 
>   The author of rtems_telnetd.
> 

SORRY I'm wrong. SORRY again.

After browsing in the versions of sources the problem was fixed.


http://www.rtems.com/cgi-bin/cvsweb.cgi/rtems/cpukit/rtems/src/tasks.c.diff?r1=1.34&r2=1.35

In tasks.c the problem can be isolated again.

 while (tvp) {   
     next = tvp->next;      
     if  (tvp->dtor)     
         (*tvp->dtor)( tvp->ptr ); <<< HERE the change and the source of the problem.          
     if (executing == deleted)      
         *tvp->ptr = tvp->gval;          
     _Workspace_Free( tvp );      

Some printk let to show the dtor, the ptr, and more...
I can't test it. Sorry.

>    
> 
>   
> > 
> > Hello,
> > 
> > trying to get telnetd to work (powerpc, rtems-4.6.0pre5) I experienced 
> > the following problem ...
> > trying various commands everything seems to work Ok, until I try to 
> > logoff from the telnet session. The system crashes, mean end up 
> > in the BSP panic handler.
> > Digging into the problem, it seems to be related with deleting a task variable.
> > If the task variable contains a pointer to malloc'ed memory and 'free' is 
> > passed to rtems_task_variable_add it will crash on deleting the task. 
> > Background: telnetd uses shell, and shell creates a 'user environment' 
> > after issuing a 'logoff', shell tries to execute a 
> > rtems_task_delete( RTEMS_SELF );  
> > which in turn, at some point calls 
> > rtems_task_variable_delete(RTEMS_SELF, ... ); 
> > 
> > The same behavior can be reproduces with a slightly modified version 
> > of 'ticker test'  
> > Adding a task variable pointing to malloc'ed space, assign different values 
> > etc. and deleting this space manually after 'rtems_task_variable_delete' 
> > everything works Ok. Passing 'free' to automatically delete this space, it 
> > ends up in the BSP panic handler.
> > 
> 
> > Did anybody experienced the same/similar problem? Or, even better, 
> > has a fix or work-around? 
> > 
> > Any information or hint is appreciated.
> > 
> > Thanks
> > Dieter Schaefer
> > 
> > PS: FTP and Web-Server runs all day long even under heavy load and 
> > with continuous ping on FEC and SCCx. 
> 
> FTP calls chroot() and chroot() builds a nes user environment the same way that telnetd.
> but FTPD runs forever.