nuttx/net/udp/udp_netpoll.c
Gregory Nutt fb8cf9373c net/udp: Resolve race condition in connection-less UDP sockets with read-ahead buffering.
In connection-mode UDP sockets, a remote address is retained in the UDP connection structure.  This determines both there send() will send the packets and which packets recv() will accept.

This same mechanism is used for connection-less UDP sendto:  A temporary remote address is written into the connection structure to support the sendto() operation.  That address persists until the next recvfrom() when it is reset to accept any address.

When UDP read-ahead buffering is enabled, however, that means that the old, invalid remote address can be left in the connection structure for some time.  This can cause read-ahead buffer to fail, dropping UDP packets.

Shortening the time between when he remote address is reset (i.e., immediately after the sendto() completes) is not a solution, that does not eliminate the race condition; in only makes it smaller.

With this change, a flag was added to the connection structure to indicate if the UDP socket is in connection mode or if it is connection-less.  This change effects only UDP receive operations:  The remote address in the UDP connection is always ignored if the UDP socket is not in connection-mode.

No for connection-mode sockets, that remote address behaves as before.  But for connection-less sockets, it is only used by sendto().
2018-05-13 09:57:34 -06:00

327 lines
9.1 KiB
C

/****************************************************************************
* net/udp/udp_netpoll.c
*
* Copyright (C) 2008-2009, 2011-2015, 2018 Gregory Nutt. All rights
* reserved.
* Author: Gregory Nutt <gnutt@nuttx.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* 3. Neither the name NuttX nor the names of its contributors may be
* used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
****************************************************************************/
/****************************************************************************
* Included Files
****************************************************************************/
#include <nuttx/config.h>
#include <stdint.h>
#include <poll.h>
#include <debug.h>
#include <nuttx/kmalloc.h>
#include <nuttx/net/net.h>
#include <devif/devif.h>
#include <socket/socket.h>
#include "udp/udp.h"
#ifdef HAVE_UDP_POLL
/****************************************************************************
* Private Types
****************************************************************************/
/* This is an allocated container that holds the poll-related information */
struct udp_poll_s
{
FAR struct socket *psock; /* Needed to handle loss of connection */
FAR struct net_driver_s *dev; /* Needed to free the callback structure */
struct pollfd *fds; /* Needed to handle poll events */
FAR struct devif_callback_s *cb; /* Needed to teardown the poll */
};
/****************************************************************************
* Private Functions
****************************************************************************/
/****************************************************************************
* Name: udp_poll_eventhandler
*
* Description:
* This function is called to perform the actual UDP receive operation
* via the device interface layer.
*
* Input Parameters:
* dev The structure of the network driver that caused the event
* conn The connection structure associated with the socket
* flags Set of events describing why the callback was invoked
*
* Returned Value:
* None
*
* Assumptions:
* This function must be called with the network locked.
*
****************************************************************************/
static uint16_t udp_poll_eventhandler(FAR struct net_driver_s *dev,
FAR void *conn,
FAR void *pvpriv, uint16_t flags)
{
FAR struct udp_poll_s *info = (FAR struct udp_poll_s *)pvpriv;
ninfo("flags: %04x\n", flags);
DEBUGASSERT(!info || (info->psock && info->fds));
/* 'priv' might be null in some race conditions (?) */
if (info)
{
pollevent_t eventset = 0;
/* Check for data or connection availability events. */
if ((flags & UDP_NEWDATA) != 0)
{
eventset |= (POLLIN & info->fds->events);
}
/* A poll is a sign that we are free to send data.
* REVISIT: This is bogus: If CONFIG_UDP_WRITE_BUFFERS=y then
* we never have to wait to send; otherwise, we always have to
* wait to send. Receiving a poll is irrelevant.
*/
if ((flags & UDP_POLL) != 0)
{
eventset |= (POLLOUT & info->fds->events);
}
/* Check for loss of connection events. */
if ((flags & NETDEV_DOWN) != 0)
{
eventset |= ((POLLHUP | POLLERR) & info->fds->events);
}
/* Awaken the caller of poll() is requested event occurred. */
if (eventset)
{
info->fds->revents |= eventset;
nxsem_post(info->fds->sem);
}
}
return flags;
}
/****************************************************************************
* Public Functions
****************************************************************************/
/****************************************************************************
* Name: udp_pollsetup
*
* Description:
* Setup to monitor events on one UDP/IP socket
*
* Input Parameters:
* psock - The UDP/IP socket of interest
* fds - The structure describing the events to be monitored, OR NULL if
* this is a request to stop monitoring events.
*
* Returned Value:
* 0: Success; Negated errno on failure
*
****************************************************************************/
int udp_pollsetup(FAR struct socket *psock, FAR struct pollfd *fds)
{
FAR struct udp_conn_s *conn = psock->s_conn;
FAR struct udp_poll_s *info;
FAR struct devif_callback_s *cb;
int ret;
/* Sanity check */
#ifdef CONFIG_DEBUG_FEATURES
if (!conn || !fds)
{
return -EINVAL;
}
#endif
/* Allocate a container to hold the poll information */
info = (FAR struct udp_poll_s *)kmm_malloc(sizeof(struct udp_poll_s));
if (!info)
{
return -ENOMEM;
}
/* Some of the following must be atomic */
net_lock();
/* Get the device that will provide the provide the NETDEV_DOWN event.
* NOTE: in the event that the local socket is bound to INADDR_ANY, the
* dev value will be zero and there will be no NETDEV_DOWN notifications.
*/
info->dev = udp_find_laddr_device(conn);
/* Allocate a UDP callback structure */
cb = udp_callback_alloc(info->dev, conn);
if (cb == NULL)
{
ret = -EBUSY;
goto errout_with_lock;
}
/* Initialize the poll info container */
info->psock = psock;
info->fds = fds;
info->cb = cb;
/* Initialize the callback structure. Save the reference to the info
* structure as callback private data so that it will be available during
* callback processing.
*/
cb->flags = 0;
cb->priv = (FAR void *)info;
cb->event = udp_poll_eventhandler;
if ((info->fds->events & POLLOUT) != 0)
{
cb->flags |= UDP_POLL;
}
if ((info->fds->events & POLLIN) != 0)
{
cb->flags |= UDP_NEWDATA;
}
if ((info->fds->events & (POLLHUP | POLLERR)) != 0)
{
cb->flags |= NETDEV_DOWN;
}
/* Save the reference in the poll info structure as fds private as well
* for use during poll teardown as well.
*/
fds->priv = (FAR void *)info;
/* Check for read data availability now */
if (!IOB_QEMPTY(&conn->readahead))
{
/* Normal data may be read without blocking. */
fds->revents |= (POLLRDNORM & fds->events);
}
/* Check if any requested events are already in effect */
if (fds->revents != 0)
{
/* Yes.. then signal the poll logic */
nxsem_post(fds->sem);
}
net_unlock();
return OK;
errout_with_lock:
kmm_free(info);
net_unlock();
return ret;
}
/****************************************************************************
* Name: udp_pollteardown
*
* Description:
* Teardown monitoring of events on an UDP/IP socket
*
* Input Parameters:
* psock - The UDP socket of interest
* fds - The structure describing the events to be monitored, OR NULL if
* this is a request to stop monitoring events.
*
* Returned Value:
* 0: Success; Negated errno on failure
*
****************************************************************************/
int udp_pollteardown(FAR struct socket *psock, FAR struct pollfd *fds)
{
FAR struct udp_conn_s *conn = psock->s_conn;
FAR struct udp_poll_s *info;
/* Sanity check */
#ifdef CONFIG_DEBUG_FEATURES
if (!conn || !fds->priv)
{
return -EINVAL;
}
#endif
/* Recover the socket descriptor poll state info from the poll structure */
info = (FAR struct udp_poll_s *)fds->priv;
DEBUGASSERT(info && info->fds && info->cb);
if (info)
{
/* Release the callback */
net_lock();
udp_callback_free(info->dev, conn, info->cb);
net_unlock();
/* Release the poll/select data slot */
info->fds->priv = NULL;
/* Then free the poll info container */
kmm_free(info);
}
return OK;
}
#endif /* !HAVE_UDP_POLL */