Problem with rtems_task_variable_delete

[Joel Sherrill]

Fernando RUIZ CASAS wrote:

>On Tue, 09 Dec 2003 01:18:32 -0800 (PST), "Fernando RUIZ CASAS" wrote:
>
>  
>
>>On Mon, 08 Dec 2003 22:58:15 +0100, Dieter Schaefer wrote:
>>Hi,
>>
>>  The same problem ago.
>>
>>  A patch has be submitted longtime ago to resolve this concern.
>>
>>  The problem is that a new implementation of core has been done.
>>
>>  The problem is in 
>>  /rtems/cpukit/rtems/src/taskvariabledelete.c
>>
>>  at line 59
>>   _Workspace_free(tvp) needs be changed by
>>   
>>   _Workspace_free(*tvp) perhaphs. (I can't test it,sorry)
>>
>>  It's a problem resolved but with the new implementation the problem arrives again.
>>
>>  A lot of mails have been interchanged with Joel to obtain a patch in the core.
>>  
>>  BRGDS. 
>>  The author of rtems_telnetd.
>>
>>    
>>
>
>SORRY I'm wrong. SORRY again.
>
>After browsing in the versions of sources the problem was fixed.
>
>
>http://www.rtems.com/cgi-bin/cvsweb.cgi/rtems/cpukit/rtems/src/tasks.c.diff?r1=1.34&r2=1.35
>
>In tasks.c the problem can be isolated again.
>
> while (tvp) {   
>     next = tvp->next;      
>     if  (tvp->dtor)     
>         (*tvp->dtor)( tvp->ptr ); <<< HERE the change and the source of the problem.          
>     if (executing == deleted)      
>         *tvp->ptr = tvp->gval;          
>     _Workspace_Free( tvp );      
>
>Some printk let to show the dtor, the ptr, and more...
>I can't test it. Sorry.
>
>  
>
The code above is the correct way to do it based upon the semantics of 
other RTOS' that provide
per-task variables.  Please (quickly) submit a patch for the shell code 
that works with t his.

>>   
>>
>>  
>>    
>>
>>>Hello,
>>>
>>>trying to get telnetd to work (powerpc, rtems-4.6.0pre5) I experienced 
>>>the following problem ...
>>>trying various commands everything seems to work Ok, until I try to 
>>>logoff from the telnet session. The system crashes, mean end up 
>>>in the BSP panic handler.
>>>Digging into the problem, it seems to be related with deleting a task variable.
>>>If the task variable contains a pointer to malloc'ed memory and 'free' is 
>>>passed to rtems_task_variable_add it will crash on deleting the task. 
>>>Background: telnetd uses shell, and shell creates a 'user environment' 
>>>after issuing a 'logoff', shell tries to execute a 
>>>rtems_task_delete( RTEMS_SELF );  
>>>which in turn, at some point calls 
>>>rtems_task_variable_delete(RTEMS_SELF, ... ); 
>>>
>>>The same behavior can be reproduces with a slightly modified version 
>>>of 'ticker test'  
>>>Adding a task variable pointing to malloc'ed space, assign different values 
>>>etc. and deleting this space manually after 'rtems_task_variable_delete' 
>>>everything works Ok. Passing 'free' to automatically delete this space, it 
>>>ends up in the BSP panic handler.
>>>
>>>      
>>>
>>>Did anybody experienced the same/similar problem? Or, even better, 
>>>has a fix or work-around? 
>>>
>>>Any information or hint is appreciated.
>>>
>>>Thanks
>>>Dieter Schaefer
>>>
>>>PS: FTP and Web-Server runs all day long even under heavy load and 
>>>with continuous ping on FEC and SCCx. 
>>>      
>>>
>>FTP calls chroot() and chroot() builds a nes user environment the same way that telnetd.
>>but FTPD runs forever.
>>    
>>