lwIP - A Lightweight TCP/IP stack - Bugs: bug #31177, tcp timers can corrupt...
You are not allowed to post comments on this tracker with your current authentication level.
bug #31177: tcp timers can corrupt tcp_active_pcbs in some cases
Submitter: | Dave Wilson <dawilson> | ||
Submitted: | Thu 30 Sep 2010 08:49:10 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | CVS Head |
Jump to the original submission
Fri 25 Nov 2011 05:39:06 PM UTC, comment #9: |
Simon Goldschmidt <goldsimon> |
Fri 25 Nov 2011 05:15:12 PM UTC, comment #8: Change the topic to reflect that this can affect tcp_fasttmr(), too. |
Simon Goldschmidt <goldsimon> |
Fri 25 Nov 2011 03:38:38 PM UTC, comment #7: Sounds reasonable. We don't expect this to happen often after all. |
Kieran Mansley <kieranm> |
Fri 25 Nov 2011 05:25:58 AM UTC, comment #6: I've prepared a patch for this which solves this by:
|
Simon Goldschmidt <goldsimon> |
Sat 03 Sep 2011 08:55:16 PM UTC, comment #5: Thinking about this, the only really safe way to fix this is to keep a "revision" of the list we are traversing, remember that revision in the loop (before calling an application callback) and comparing it later.
|
Simon Goldschmidt <goldsimon> |
Tue 11 Jan 2011 02:01:13 PM UTC, comment #4: I think this relates as much to CVS head as to 1.3.2, so updating summary.
|
Kieran Mansley <kieranm> |
Mon 22 Nov 2010 03:44:46 PM UTC, comment #3: Thanks, Simon - it makes a difference when you really know the guts of the stack! I had not considered this possibility at all. I'll leave this fix in my copy for now since it definitely works better than the previous version for us. I will, however, go back in and rework based on your feedback when I have a chance.
|
Dave Wilson <dawilson> |
Sat 20 Nov 2010 07:17:39 PM UTC, comment #2: The problem I see here is that when allocating a new pcb from one of those callbacks, any of the pcbs on the list can disappear if the MEMP_TCP_PCB pool is empty and tcp_alloc() calls tcp_kill_prio(). The pcb aborted by tcp_kill_prio() might even be the one we want to check next ('pcb').
|
Simon Goldschmidt <goldsimon> |
Fri 01 Oct 2010 12:33:44 PM UTC, comment #1: In reviewing this change, I realised that I had not taken into account the case where the active PCB list is empty after the PCB is removed. As a result, the suggested fix should actually be:
|
Dave Wilson <dawilson> |
Thu 30 Sep 2010 08:49:10 PM UTC, original submission:
If a client error callback function (registered using tcp_err) allocates a new PCB then function tcp_slowtmr() can corrupt tcp_active_pcbs in some cases. This was seen in an application which makes 2 connections to a telnet server. In cases where the server is down when the initial connection attempt is made and tcp_slowtmr() detects the "Max SYN retries" case and removes the PCBs from tcp_active_pcbs list, we got into a state where one of the 2 connections was never reestablished when the server came back online.
|
Dave Wilson <dawilson> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2011-11-25 | goldsimon | Status | In Progress | Fixed | |
Open/Closed | Open | Closed | |||
2011-11-25 | goldsimon | Status | None | In Progress | |
Assigned to | None | goldsimon | |||
Summary | tcp_slowtmr() can corrupt tcp_active_pcbs in some cases. | tcp timers can corrupt tcp_active_pcbs in some cases | |||
2011-11-25 | goldsimon | Attached File | - | Added fix_31177.patch, #24447 | |
2011-01-11 | kieranm | Planned Release | 1.4.1 | ||
Summary | lwIP 1.3.2 tcp_slowtmr() can corrupt tcp_active_pcbs in some cases. | tcp_slowtmr() can corrupt tcp_active_pcbs in some cases. | |||
2010-09-30 | dawilson | Carbon-Copy | - | Added -email is unavailable- |
Powered by Savane 3.13-4448.
Corresponding source code
Fixed with the proposed patch.