Bug Description:
The original code always used conn->pollinfo[0] (the first element) to store
new poll setup context, regardless of whether that slot was already in use.
This caused multiple poll operations on the same CAN socket to overwrite each
other's context, leading to:
- Lost poll waiters when multiple threads poll the same socket
- Memory corruption in pollfd structures
- Undefined behavior when poll_teardown tries to clean up
Root Cause:
The code directly assigned `info = conn->pollinfo` without checking if the
slot was available, effectively always using pollinfo[0]. When a second
thread called poll() on the same socket, it would overwrite the first
thread's poll context.
Solution:
1. Initialize info to NULL instead of conn->pollinfo
2. Before setting up poll, iterate through all CONFIG_NET_CAN_NPOLLWAITERS
slots to find the first free slot (where fds == NULL)
3. Return -EBUSY if no free slots are available
4. During teardown, properly mark the slot as free by setting fds = NULL
Additional Changes:
- Added CONFIG_NET_CAN_NPOLLWAITERS Kconfig option (default 4) to make the
maximum number of concurrent poll waiters configurable
- Changed hardcoded array size from 4 to CONFIG_NET_CAN_NPOLLWAITERS
- Fixed lock ordering in teardown to ensure fds is cleared before unlock
Impact:
- Enables multiple threads to safely poll the same CAN socket concurrently
- Prevents poll context corruption in multi-threaded applications
- Provides proper resource management with -EBUSY when all slots are full
- Makes the number of supported concurrent pollers configurable per use case
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
To avoid memory waste, can add support for using an independent iob buffer
The IP protocol often configures CONFIG_IOB_BUFSIZE to be relatively large,
such as 512, for higher throughput. However, the buffer required by CAN is
fixed at a length of 16 or 64. If the system's IOB is directly used,
a lot of memory will be wasted.
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
Implement si_send/sendto/recvfrom with si_sendmsg/recvmsg, instead of
the other way round.
Change-Id: I7b858556996e0862df22807a6edf6d7cfe6518fc
Signed-off-by: Peter Bee <bijunda1@xiaomi.com>
