From 77534e2b49bc30ef5da8237182228efe3ae6baea Mon Sep 17 00:00:00 2001
From: Gregory Nutt <gnutt@nuttx.org>
Date: Mon, 21 Aug 2017 08:18:53 -0600
Subject: [PATCH] PF_IEEE802154:  Improve some backlog counting logic; add more
 assertions to catch cases where the backlog count might deviate from the
 actual backlog.

---
 net/ieee802154/ieee802154_input.c    | 30 ++++++++++++++++-----------
 net/ieee802154/ieee802154_recvfrom.c | 31 ++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/net/ieee802154/ieee802154_input.c b/net/ieee802154/ieee802154_input.c
index d69fd49527..1d50451cc3 100644
--- a/net/ieee802154/ieee802154_input.c
+++ b/net/ieee802154/ieee802154_input.c
@@ -69,8 +69,8 @@
  *
  ****************************************************************************/
 
-#ifdef CONFIG_DEBUG_ASSERTIONS
-int ieee802154_count_frames(FAR struct ieee802154_conn_s *conn)
+#if defined(CONFIG_DEBUG_ASSERTIONS) && CONFIG_NET_IEEE802154_BACKLOG > 0
+static int ieee802154_count_frames(FAR struct ieee802154_conn_s *conn)
 {
   FAR struct ieee802154_container_s *container;
   int count;
@@ -102,9 +102,9 @@ int ieee802154_count_frames(FAR struct ieee802154_conn_s *conn)
  *
  ****************************************************************************/
 
-int ieee802154_queue_frame(FAR struct ieee802154_conn_s *conn,
-                           FAR struct iob_s *frame,
-                           FAR struct ieee802154_data_ind_s *meta)
+static int ieee802154_queue_frame(FAR struct ieee802154_conn_s *conn,
+                                  FAR struct iob_s *frame,
+                                  FAR struct ieee802154_data_ind_s *meta)
 {
   FAR struct ieee802154_container_s *container;
 
@@ -150,16 +150,14 @@ int ieee802154_queue_frame(FAR struct ieee802154_conn_s *conn,
     }
 
 #if CONFIG_NET_IEEE802154_BACKLOG > 0
-   /* Increment the count of frames in the queue.  If the count exceeds the
-    * maximum backlog value, then delete the oldest frame from the head of
-    * the RX queue.
+   /* If incrementing the count would exceed the maximum backlog value, then
+    * delete the oldest frame from the head of the RX queue.
     */
 
-   conn->backlog++;
-   DEBUGASSERT((int)conn->backlog == ieee802154_count_frames(conn));
-
-   if (conn->backlog > CONFIG_NET_IEEE802154_BACKLOG)
+   if (conn->backlog >= CONFIG_NET_IEEE802154_BACKLOG)
      {
+      DEBUGASSERT(conn->backlog == CONFIG_NET_IEEE802154_BACKLOG);
+
       /* Remove the container from the tail RX input queue. */
 
       container           = conn->rxhead;
@@ -181,6 +179,14 @@ int ieee802154_queue_frame(FAR struct ieee802154_conn_s *conn,
       iob_free(container->ic_iob);
       ieee802154_container_free(container);
      }
+   else
+     {
+       /* Increment the count of frames in the queue. */
+
+       conn->backlog++;
+     }
+
+   DEBUGASSERT((int)conn->backlog == ieee802154_count_frames(conn));
 #endif
 
   return OK;
diff --git a/net/ieee802154/ieee802154_recvfrom.c b/net/ieee802154/ieee802154_recvfrom.c
index 07ccfa7767..1801781634 100644
--- a/net/ieee802154/ieee802154_recvfrom.c
+++ b/net/ieee802154/ieee802154_recvfrom.c
@@ -81,6 +81,36 @@ struct ieee802154_recvfrom_s
  * Private Functions
  ****************************************************************************/
 
+/****************************************************************************
+ * Name: ieee802154_count_frames
+ *
+ * Description:
+ *   Return the number of frames in the RX queue.
+ *
+ * Parameters:
+ *   conn   - The socket connection structure.
+ *
+ * Return:
+ *   The number of frames in the queue.
+ *
+ ****************************************************************************/
+
+#if defined(CONFIG_DEBUG_ASSERTIONS) && CONFIG_NET_IEEE802154_BACKLOG > 0
+static int ieee802154_count_frames(FAR struct ieee802154_conn_s *conn)
+{
+  FAR struct ieee802154_container_s *container;
+  int count;
+
+  for (count = 0, container = conn->rxhead;
+       container != NULL;
+       count++, container = container->ic_flink)
+    {
+    }
+
+  return count;
+}
+#endif
+
 /****************************************************************************
  * Name: ieee802154_recvfrom_sender
  *
@@ -134,6 +164,7 @@ static ssize_t ieee802154_recvfrom_rxqueue(FAR struct radio_driver_s *radio,
 
        DEBUGASSERT(conn->backlog > 0);
        conn->backlog--;
+       DEBUGASSERT((int)conn->backlog == ieee802154_count_frames(conn));
 #endif
 
       /* Extract the IOB containing the frame from the container */