buglwIP - A Lightweight TCP/IP stack - Bugs: bug #20315, Problem in the use of tcp_listen...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #20315: Problem in the use of tcp_listen in api_msg.c

Submitter:  Frédéric Bernon <fbernon>
Submitted:  Mon 02 Jul 2007 08:12:33 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  fbernon
Open/Closed:  Closed Planned Release:  None
lwIP version:  None

Jump to the original submission

Fri 13 Jul 2007 01:59:59 PM UTC, comment #7: 

Ok, since no objects, it's check in...

Frédéric Bernon <fbernon>
Group Member
Tue 10 Jul 2007 01:32:18 PM UTC, comment #6: 

I attach a patch file. In rawapi.txt, we can read :

"tcp_listen() may return NULL if no memory was available for the
listening connection. If so, the memory associated with the pcb
passed as an argument to tcp_listen() will not be deallocated."

So, the change is only in api_msg.c. Problem, it's always possible that tcp_listen return a valid pcb, but that the sys_mbox_new for acceptmbox failed: in this case the pcb can't be used, and should be closed. The sys_mbox_new success is a port problem, so, since a LWIP_ERROR is used in netconn_accept, I think the patch is enough.

Ok for you?


(file #13282)

Frédéric Bernon <fbernon>
Group Member
Wed 04 Jul 2007 09:23:50 AM UTC, comment #5: 

It should be only in one list at every time.

It should be on the bound list when calling tcp_listen, so you'd have to remove it from there, not from the active list, that's right.

Maybe we should include a check at the beginning that it isn't active yet and fail if it is. That would solve the netconn issues with converting from connection- to listen-pcb, also. Only bad thing is we don't have a return value here...

Maybe the automatic-freeing is not so good after all...

Simon Goldschmidt <goldsimon>
Group administrator
Wed 04 Jul 2007 09:05:37 AM UTC, comment #4: 

Uhmm is the pcb in both lists (active/bound) or in only one? I will study that... Hopefully, I don't have check in yet...

Frédéric Bernon <fbernon>
Group Member
Wed 04 Jul 2007 08:29:25 AM UTC, comment #3: 

Wait a minute.
Why tcp_pcb_remove(&tcp_active_pcbs, pcb); ?
May be the same as in success case

  TCP_RMV(&tcp_bound_pcbs, pcb);
  memp_free(MEMP_TCP_PCB, pcb);

Oleg Tyshev <olegreen>
Mon 02 Jul 2007 10:04:54 AM UTC, comment #2: 

Agree with you. Ok, if no objects, I will add...

tcp_pcb_remove(&tcp_active_pcbs, pcb);
memp_free(MEMP_TCP_PCB, pcb);
 
in tcp_listen this afternoon...

Frédéric Bernon <fbernon>
Group Member
Mon 02 Jul 2007 09:43:32 AM UTC, comment #1: 

If returning NULL we should delete the old pcb. Otherwise we could return the old pcb, but that would leave no indication whether listen succeeded or not, so I would favour deallocating the old pcb.

Simon Goldschmidt <goldsimon>
Group administrator
Mon 02 Jul 2007 08:12:33 AM UTC, original submission:  

In do_listen (in api_msg.c file), the tcp_listen call is :

msg->conn->pcb.tcp = tcp_listen(msg->conn->pcb.tcp);

The problem is that, if tcp_listen can't alloc a tcp_pcb_listen (memp_malloc(MEMP_TCP_PCB_LISTEN) return NULL), the pcb.tcp used to listen is lost (since the msg->conn->pcb.tcp is directly set, without any error checking).

I suppose that perhaps, a processing in a TCP timer will free the pcb.tcp, but I think it should be directly delete in tcp_listen, like this:

  lpcb = memp_malloc(MEMP_TCP_PCB_LISTEN);
  if (lpcb == NULL) {
    tcp_pcb_remove(&tcp_active_pcbs, pcb);
    memp_free(MEMP_TCP_PCB, pcb);
    return NULL;
  }

Can I have your comments about that?


Frédéric Bernon <fbernon>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #13282:  do_listen.txt added by fbernon (736B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kieranm (Updated the item)
  • -email is unavailable- added by olegreen (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by fbernon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-07-13 fbernon StatusNone Fixed
        Open/ClosedOpen Closed
    2007-07-13 kieranm Planned Release 1.3.0
    2007-07-10 fbernon Attached File- Added do_listen.txt, #13282

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code