buglwIP - A Lightweight TCP/IP stack - Bugs: bug #26027, Chaining netbufs

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #26027: Chaining netbufs

Submitter:  Hans-Erik Floryd <hefloryd>
Submitted:  Fri 27 Mar 2009 01:48:56 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.3.0

Wed 15 Apr 2009 02:57:51 PM UTC, comment #1: 

I just wondered who can ever have uses netbuf_chain without a big memory leak?

I've changed it to calling pbuf_cat instead of pbuf_chain so that the second netbuf must not be referenced/freed after passing it to netbuf_chain.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 27 Mar 2009 01:48:56 PM UTC, original submission:  

When trying to chain two netbufs (identifier and payload) together, netbuf_chain calls memp_free on the tail. It is unclear if/how the pbuf associated with the tail can then be reclaimed. Test case:

   identifier = netbuf_new();
   payload = netbuf_new();

   netbuf_ref (identifier, pId, pIdSize);
   netbuf_ref (payload, pData, pDataSize);
   netbuf_chain (identifier, payload);

   netconn_sendto (conn, identifier, &addr, port);
   netbuf_delete (payload);
   netbuf_delete (identifier);

netbuf_chain calls memp_free on the tail (i.e. payload), so when netbuf_delete(payload) is called, payload is no longer valid. On the other hand, if netbuf_delete(payload) is not called, a pbuf is lost because the reference count on the payload data is two, so netbuf_delete(identifier) will not free the data.

Is it correct for netbuf_chain to free the tail netbuf? If that one line is removed the code above works fine.

-email is unavailable- suggested this in the lwip-users mailing list:
"[...] from reading the code, netbuf_chain should either call netbuf_delete, use pbuf_cat instead of pbuf_chain or don't call memp_free. Which is right I don't know."



Hans-Erik Floryd <hefloryd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by kieranm (Updated the item)
  • -email is unavailable- added by hefloryd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-04-15 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2009-04-03 kieranm Planned Release 1.3.1

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code