STABLE12-rx-peer-and-conn-refcounts-now-unsigned-int32-20041015

FIXES 15459

in an extreme case, the peer object refcount could wrap

we should probably also log if wrapping is imminent

(cherry picked from commit 85835f169cf47207795e00cbc2dae6fd77950f78)

diff --git a/src/rx/rx.c b/src/rx/rx.c
index 93cdb1a56ca1192e30deb2e091783915f7348be4..f0dda84305767ba2ba4dd1ec1715b72b24bdce5d 100644 (file)
--- a/src/rx/rx.c
+++ b/src/rx/rx.c
@@ -796,15 +796,16 @@ void rxi_CleanupConnection(conn)
      * idle (refCount == 0) after rx_idlePeerTime (60 seconds) have passed.
      */
     MUTEX_ENTER(&rx_peerHashTable_lock);
-    if (--conn->peer->refCount <= 0) {
-       conn->peer->idleWhen = clock_Sec();
-       if (conn->peer->refCount < 0) {
-           conn->peer->refCount = 0; 
-           MUTEX_ENTER(&rx_stats_mutex);
-           rxi_lowPeerRefCount ++;
-           MUTEX_EXIT(&rx_stats_mutex);
-       }
+    if (conn->peer->refCount < 2) {
+        conn->peer->idleWhen = clock_Sec();
+       if (conn->peer->refCount < 1) {
+            conn->peer->refCount = 1;
+            MUTEX_ENTER(&rx_stats_mutex);
+            rxi_lowPeerRefCount++;
+            MUTEX_EXIT(&rx_stats_mutex);
+        }
     }
+    conn->peer->refCount--;
     MUTEX_EXIT(&rx_peerHashTable_lock);
 
     MUTEX_ENTER(&rx_stats_mutex);

diff --git a/src/rx/rx.h b/src/rx/rx.h
index 8cadf0b7c63a5f704cca52e1eacd3f0a501b3246..4c6ff9d5a676165f2e223f853aacc22e5a73e455 100644 (file)
--- a/src/rx/rx.h
+++ b/src/rx/rx.h
@@ -411,7 +411,7 @@ struct rx_peer {
 
     /* For garbage collection */
     afs_uint32 idleWhen;                   /* When the refcountwent to zero */
-    short refCount;                /* Reference count for this structure */
+    afs_uint32 refCount;                   /* Reference count for this structure */
 
     /* Congestion control parameters */
     u_char burstSize;              /* Reinitialization size for the burst parameter */
@@ -496,7 +496,7 @@ struct rx_connection {
                                     /* client-- to retransmit the challenge */
     struct rx_service *service;            /* used by servers only */
     u_short serviceId;             /* To stamp on requests (clients only) */
-    u_short refCount;              /* Reference count */
+    afs_uint32 refCount;                   /* Reference count */
     u_char flags;                  /* Defined below */
     u_char type;                   /* Type of connection, defined below */
     u_char secondsUntilPing;       /* how often to ping for each active call */
@@ -619,7 +619,7 @@ struct rx_call {
     struct clock traceStart;       /* time the call started running */
     u_short MTU;                    /* size of packets currently sending */
 #ifdef RX_ENABLE_LOCKS
-    short refCount;                /* Used to keep calls from disappearring
+    u_short refCount;              /* Used to keep calls from disappearring
                                       when we get them from a queue. */
 #endif /* RX_ENABLE_LOCKS */
 /* Call refcount modifiers */
@@ -633,7 +633,7 @@ struct rx_call {
 #define RX_CALL_REFCOUNT_ABORT  7 /* delayed abort */
 #define RX_CALL_REFCOUNT_MAX    8 /* array size. */
 #ifdef RX_REFCOUNT_CHECK
-    short refCDebug[RX_CALL_REFCOUNT_MAX];
+    u_short refCDebug[RX_CALL_REFCOUNT_MAX];
 #endif  /* RX_REFCOUNT_CHECK */
     int iovNBytes;             /* byte count for current iovec */
     int iovMax;                        /* number elements in current iovec */
@@ -921,7 +921,7 @@ struct rx_debugPeer {
     u_short port;
     u_short ifMTU;
     afs_uint32 idleWhen;
-    short refCount;
+    u_short refCount;
     u_char burstSize;
     u_char burst;
     struct clock burstWait;