Re: [tcpdump-workers] Losing BPF's

2007-02-20 Thread Guy Harris
maneeshs wrote: There seems to be a race condition in the above code, the check for the descriptor being free and the call to D_GET to mark the descriptor as being used is not atomic. So two closely spaced calls to bpfopen could cause bpf to use the same device twice ? Yes, if, in OpenBSD, e

Re: [tcpdump-workers] Losing BPF's

2007-02-20 Thread maneeshs
If so, then that open routine: int bpfopen(dev_t dev, int flag, int mode, struct proc *p) { struct bpf_d *d; /* create on demand */ if ((d = bpfilter_create(minor(dev))) == NULL) return (ENXIO); /* * Each minor can be opened by only one

Re: [tcpdump-workers] Losing BPF's

2007-02-19 Thread Guy Harris
Jon Steel wrote: I did some more digging and I think Ive narrowed the problem down a bit more. It does appear to be a kernel issue. pcaps off the hook for today. For those interested, the problem occurs for the following reasons: When you call open() on OpenBSD it does not lock the file unless y

Re: [tcpdump-workers] Losing BPF's

2007-02-19 Thread Jon Steel
I did some more digging and I think Ive narrowed the problem down a bit more. It does appear to be a kernel issue. pcaps off the hook for today. For those interested, the problem occurs for the following reasons: When you call open() on OpenBSD it does not lock the file unless you tell it to. This

Re: [tcpdump-workers] Losing BPF's

2007-02-19 Thread Guy Harris
Guy Harris wrote: I can't reproduce this on OS X 10.4 - I get $ sudo ./bpfMaker.pl en1 BPF's at startup:0 BPF's upon ending:0 ...with a version of bpftest.c fixed so that, if pcap_open_live() fails, it returns before calling pcap_loop() (otherwise, it dumps core,

Re: [tcpdump-workers] Losing BPF's

2007-02-19 Thread Guy Harris
Jon Steel wrote: I have found a potential bug in libpcap on OpenBSD and likely FreeBSD as well. If you simultaneously open several programs that open pcap connections, you can cause the system to lose track of some of its BPF's. When you close all the pcap connections some of the BPF's may repor

[tcpdump-workers] Losing BPF's

2007-02-16 Thread Jon Steel
Hello I have found a potential bug in libpcap on OpenBSD and likely FreeBSD as well. If you simultaneously open several programs that open pcap connections, you can cause the system to lose track of some of its BPF's. When you close all the pcap connections some of the BPF's may report that they a

[tcpdump-workers] Losing BPF's

2007-02-16 Thread Jon Steel
Hello I have found a potential bug in libpcap on OpenBSD and likely FreeBSD as well. If you simultaneously open several programs that open pcap connections, you can cause the system to lose track of some of its BPF's. When you close all the pcap connections some of the BPF's may report that they a