buglwIP - A Lightweight TCP/IP stack - Bugs: bug #28562, Segfault @ err_tcp

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #28562: Segfault @ err_tcp

Submitter:  Homyak <onlyslon>
Submitted:  Tue 12 Jan 2010 11:47:47 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  CVS Head

Jump to the original submission

Sat 23 Jan 2010 03:06:14 PM UTC, comment #9: 

Closing since fixed with the last comment already

Simon Goldschmidt <goldsimon>
Group administrator
Thu 14 Jan 2010 03:43:47 PM UTC, comment #8: 

I think the cause rather might be 'conn->pcb.tcp = NULL;' in err_tcp(), because the one in netconn_delete() is executed after do_delconn() (which in turn executes netconn_drain()).

Anyway, I didn't think the pcb might be null here, which it can (due to err_tcp), so I've included an if(!=NULL) around the calls, which should solve the problem.

Simon Goldschmidt <goldsimon>
Group administrator
Thu 14 Jan 2010 03:35:42 PM UTC, comment #7: 

little more info


TCP thread
[Switching to thread 1 (Thread 28899)]#0  0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
447       pcb->rcv_wnd += len;
(gdb) bt
#0  0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
#1  0x0808f003 in netconn_drain (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
#2  0x0808f266 in do_delconn (msg=0xb4e7a388) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:712
#3  0x08061dfa in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:100
(gdb) up
#1  0x0808f003 in netconn_drain (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
622               tcp_recved(conn->pcb.tcp, p->tot_len);
(gdb) p *conn
$2 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x89a7108, recvmbox = 0x0,
  acceptmbox = 0x0, socket = 9, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 438, write_msg = 0x0, write_offset = 0,
  callback = 0x806e691 <sx3g_event_callback>}

TCP READ_THREAD
----------------------------------
(gdb) bt
#0  0xb7f09410 in ?? ()
#1  0x0806413d in cond_wait (cond=0x89a710c, mutex=0x89a713c, timeout=0) at lwip/cvs/contrib/ports/unix/sys_arch.c:635
#2  0x080641cf in sys_arch_sem_wait (sem=0x89a7108, timeout=0) at lwip/cvs/contrib/ports/unix/sys_arch.c:662
#3  0x08062157 in tcpip_apimsg (apimsg=0xb4e7a384) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:289
#4  0x0808df6e in netconn_delete (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#5  0x0806bbc4 in lwip_socket_close (s=9) at sockets.c:421
#6  0x0806a063 in tcp_read_thread (arg=0x88360e8) at tcp_handlers.c:408


Possibly cause

 conn->pcb.tcp = NULL; at netconn_delete @ api_lib.c

Homyak <onlyslon>
Thu 14 Jan 2010 03:10:40 PM UTC, comment #6: 

I got segfault again 8-(

it look like this....
(gdb) bt
#0  0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
#1  0x0808f003 in netconn_drain (conn=0x8262234) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
#2  0x0808f266 in do_delconn (msg=0xb4e7a388) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:712
#3  0x08061dfa in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:100
#4  0xb7a50240 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0xb7e1c4ae in clone () from /lib/tls/i686/cmov/libc.so.6


Homyak <onlyslon>
Thu 14 Jan 2010 01:27:24 PM UTC, comment #5: 

Segfault no longer occurs.
Thanks Simon.


Homyak <onlyslon>
Wed 13 Jan 2010 04:00:29 PM UTC, comment #4: 

Fixed. Homyak, can you verify it works?

Simon Goldschmidt <goldsimon>
Group administrator
Tue 12 Jan 2010 06:30:41 PM UTC, comment #3: 

Yes, it's a result of fixing bug #26672, which I did just four days ago.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 12 Jan 2010 04:18:14 PM UTC, comment #2: 

Can I check that this was introduced after 1.3.2?

Kieran Mansley <kieranm>
Group Member
Tue 12 Jan 2010 03:32:18 PM UTC, comment #1: 

Thanks for the excellent report! I don't know where I had my mind when writing that code, but setting recvmbox/acceptmbox to SYS_MBOX_NULL from the application thread is of course wrong and the source of this bug.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 12 Jan 2010 11:47:47 AM UTC, original submission:  

Have 2 threads. - tcp/ip thread & tcp read thread.



it look like lwip bug, but Im not sure. Please fix me if I mistaken

Thanks.


Ok.  I just have segfault sometimes

TCP thread  backtrace -
------------------------------------
#0  0x08063b10 in sys_mbox_post (mbox=0x0, msg=0x0) at lwip/cvs/contrib/ports/unix/sys_arch.c:372
#1  0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
#2  0x0808a7d1 in tcp_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/tcp_in.c:313
#3  0x08060db7 in ip_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/ipv4/ip.c:417
#4  0x08061e3c in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:111
#5  0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#6  0xb7e523ae in clone () from /lib/libc.so.6
(gdb) up
#1  0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
322         sys_mbox_post(conn->recvmbox, NULL);
(gdb) p *conn
$4 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x899e998, recvmbox = 0x0,
  acceptmbox = 0x0, socket = 2, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 0, write_msg = 0x0, write_offset = 0,
  callback = 0x806e77d <sx3g_event_callback>}

 

READER thread backtrace
(gdb) bt
#2  0xb7e5eb84 in pthread_cond_timedwait () from /lib/libc.so.6
#3  0x08064138 in cond_wait (cond=0x89db07c, mutex=0x89db0ac, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:617
#4  0x08064223 in sys_arch_sem_wait (sem=0x89db078, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:650
#5  0x08063d58 in sys_arch_mbox_fetch (mbox=0x8abb148, msg=0xb4f04298, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:476
#6  0x0808efe3 in netconn_drain (conn=0x826216c, bytes_drained=0xb4f042d0, accepts_drained=0xb4f042ce) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:624
#7  0x0808dec7 in netconn_delete (conn=0x826216c) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#8  0x0806bcb0 in lwip_close (s=2) at  sockets.c:421
#9  0x0806a14f in tcp_read_thread (arg=0x8836328) at tcp_handlers.c:408
#10 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#11 0xb7e523ae in clone () from /lib/libc.so.6


Situation - 
- we got RST from remote side
- tcp/ip thread call err_tcp
@api_msg.c line 319

  if (conn->recvmbox != SYS_MBOX_NULL) {
    /* Register event with callback */
    API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0);
    sys_mbox_post(conn->recvmbox, NULL);
  }


-  After   API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0); TCP read thread got  waked  and start trying read from socket and cause lwip_read returned - 0 bytes - trying to close socket

- First all lwip_close call netconn_delete -> netconn_drain
netconn_drain set recvmbox to SYS_MBOX_NULL and after switch context to tcp/ip thread we got segfault at sys_mbox_post(conn->recvmbox, NULL);  cause recvmbox = NULL

  Plsease fix me if I wrong.

Homyak <onlyslon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kieranm (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by onlyslon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-01-23 goldsimon Open/ClosedOpen Closed
    2010-01-13 goldsimon StatusConfirmed Fixed
    2010-01-12 goldsimon StatusNone Confirmed
        Assigned toNone goldsimon

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code