You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
3df7537a30
Lengthy explanation follows... First, the scenario before this patch: We have three clients 1,2,3 connected. The main thread loops through them using rfbClientIteratorNext() (loop L1) and is currently at client 2 i.e. client 2's cl_2->refCount is 1. At this point we need to loop again through the clients, with cl_2->refCount == 1, i.e. do a loop L2 nested within loop L1. BUT: Now client 2 disconnects, it's clientInput thread terminates its clientOutput thread and calls rfbClientConnectionGone(). This LOCKs clientListMutex and WAITs for cl_2->refCount to become 0. This means this thread waits for the main thread to release cl_2. Waiting, with clientListMutex LOCKed! Meanwhile, the main thread is about to begin the inner rfbClientIteratorNext() loop L2. The first call to rfbClientIteratorNext() LOCKs clientListMutex. BAAM. This mutex is locked by cl2's clientInput thread and is only released when cl_2->refCount becomes 0. The main thread would decrement cl_2->refCount when it would continue with loop L1. But it's waiting for cl2's clientInput thread to release clientListMutex. Which never happens since this one's waiting for the main thread to decrement cl_2->refCount. DEADLOCK. Now, situation with this patch: Same as above, but when client 2 disconnects it's clientInput thread rfbClientConnectionGone(). This again LOCKs clientListMutex, removes cl_2 from the linked list and UNLOCKS clientListMutex. The WAIT for cl_2->refCount to become 0 is _after_ that. Waiting, with clientListMutex UNLOCKed! Therefore, the main thread can continue, do the inner loop L2 (now only looping through 1,3 - 2 was removed from the linked list) and continue with loop L1, finally decrementing cl_2->refCount, allowing cl2's clientInput thread to continue and terminate. The resources held by cl2 are not free()'d by rfbClientConnectionGone until cl2->refCount becomes 0, i.e. loop L1 has released cl2. |
14 years ago | |
|---|---|---|
| .. | ||
| tightvnc-filetransfer | 15 years ago | |
| Makefile.am | 15 years ago | |
| auth.c | 15 years ago | |
| cargs.c | 15 years ago | |
| config.h | 22 years ago | |
| corre.c | 15 years ago | |
| cursor.c | 16 years ago | |
| cutpaste.c | 15 years ago | |
| draw.c | 15 years ago | |
| font.c | 15 years ago | |
| hextile.c | 15 years ago | |
| httpd.c | 15 years ago | |
| main.c | 15 years ago | |
| private.h | 15 years ago | |
| rfbconfig.h | 22 years ago | |
| rfbcrypto.h | 15 years ago | |
| rfbcrypto_gnutls.c | 15 years ago | |
| rfbcrypto_included.c | 15 years ago | |
| rfbcrypto_openssl.c | 15 years ago | |
| rfbcrypto_polarssl.c | 15 years ago | |
| rfbregion.c | 15 years ago | |
| rfbserver.c | 14 years ago | |
| rfbssl.h | 15 years ago | |
| rfbssl_gnutls.c | 15 years ago | |
| rfbssl_none.c | 15 years ago | |
| rfbssl_openssl.c | 15 years ago | |
| rre.c | 15 years ago | |
| scale.c | 15 years ago | |
| scale.h | 15 years ago | |
| selbox.c | 15 years ago | |
| sockets.c | 15 years ago | |
| stats.c | 15 years ago | |
| tableinit24.c | 15 years ago | |
| tableinitcmtemplate.c | 15 years ago | |
| tableinittctemplate.c | 15 years ago | |
| tabletrans24template.c | 15 years ago | |
| tabletranstemplate.c | 15 years ago | |
| tight.c | 15 years ago | |
| translate.c | 15 years ago | |
| ultra.c | 15 years ago | |
| websockets.c | 15 years ago | |
| zlib.c | 17 years ago | |
| zrle.c | 15 years ago | |
| zrleencodetemplate.c | 15 years ago | |
| zrleoutstream.c | 21 years ago | |
| zrleoutstream.h | 22 years ago | |
| zrlepalettehelper.c | 22 years ago | |
| zrlepalettehelper.h | 22 years ago | |
| zrletypes.h | 15 years ago | |