buglwIP - A Lightweight TCP/IP stack - Bugs: bug #28049, Keep Alive timeout frees pcb then...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #28049: Keep Alive timeout frees pcb then uses it, sometimes causing crash error.

Submitter:  Mike <mikeredd>
Submitted:  Wed 18 Nov 2009 10:24:46 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.3.1

Sun 22 Nov 2009 03:45:00 PM UTC, comment #2: 

Fixed by calling tcp_rst() instead of tcp_abort() in tcp_slowtmr() when retransmit timer expires.

Thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 20 Nov 2009 05:05:22 PM UTC, comment #1: 

The fix would be OK, but I think we might rather change the code to not call tcp_abort at that place:

The keepalive timer is the only timer inside tcp_slowtmr calling tcp_abort, all other timers increase pcb_remove. The difference is mainly that by this, the keepalive timer send directly sends a RST when expiring while the other timers don't.

Is there a reason for this? Kieran maybe?

This is a fairly old bug (has been in there since 1.32 from 6 years ago...).

Simon Goldschmidt <goldsimon>
Group administrator
Wed 18 Nov 2009 10:24:46 PM UTC, original submission:  

Inside of tcp_slowtmr(), when a keepalive timeout occurs, tcp_abort() is called for the pcb.  This frees the pcb.

The pcb pointer remains, however, and "pcb = pcb->next" is called at the end of the loop.  This causes crash sometimes (because memory can be reallocated during the sending of the RST)and is very tifficult to trace.

Here is a fix (it is also attached):


----- tcp.c (old), line 669 -----

        tcp_abort(pcb);

----- tcp.c (new), line 669-672 -----

        pcb2 = pcb->next;
        tcp_abort(pcb);
        pcb = pcb2;
        continue;

-----

Mike <mikeredd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #19079:  tcp.c added by mikeredd (42KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by kieranm (Updated the item)
  • -email is unavailable- added by mikeredd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-11-22 goldsimon Assigned toNone goldsimon
        Open/ClosedOpen Closed
        StatusNeed Info Fixed
    2009-11-20 goldsimon StatusNone Need Info
    2009-11-19 kieranm Planned Release 1.3.2
    2009-11-18 mikeredd Attached File- Added tcp.c, #19079

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code