lwIP - A Lightweight TCP/IP stack - Bugs: bug #38210, ip reassembly while remove oldest...
You are not allowed to post comments on this tracker with your current authentication level.
bug #38210: ip reassembly while remove oldest datagram
Submitter: | daijun <sydnash> | ||
Submitted: | Thu 31 Jan 2013 12:50:57 AM UTC | ||
Category: | IPv4 | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | 1.4.1 |
Wed 25 Feb 2015 08:43:57 PM UTC, comment #2: |
Simon Goldschmidt <goldsimon> |
Fri 28 Jun 2013 09:14:09 PM UTC, comment #1: I've just run into this bug. Here's what I think is going on. The problem occurs when the reassdatagrams list contains IP_REASS_MAX_PBUFS (defaults to 10) datagrams and a new fragmented datagram arrives. If IP_REASS_FREE_OLDEST is defined (which it is by default) the oldest datagram is attempted to be freed by calling ip_reass_remove_oldest_datagram(). This function walks the reassdatagrams list keeping oldest and prev pointers. The prev pointer is bumped along at each iteration. The oldest pointer is set when the current datagram does not match the incoming datagram and the current datagram is older than the previous oldest (which, I believe, is always the case). Normally, you run to the end of the list with oldest pointing to the last entry and prev pointing to the previous entry. The bug happens when the last entry does match the incoming datagram. In that case the oldest pointer does not change but the prev pointer does, which ends up with oldest == prev. Then, the oldest datagram is freed and the prev next pointer is updated to point to the datagram's next pointer. But, since oldest == prev, this only messes with the to-be-freed datagram and doesn't do anything to the true previous datagram which will remain pointed to the newly freed datagram. Now the freed datagram is re-allocated for the new, incoming datagram. You'll likely get the memory that was just freed. The new datagram is then added to the start of the reassdatagrams list. So now the last entry in the list points to the first entry. Loop!
|
Greg Renda <greg> |
Thu 31 Jan 2013 12:50:57 AM UTC, original submission:
at ip_reass_remove_oldest_datagram function.
|
daijun <sydnash> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 6 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2015-02-25 | goldsimon | Status | None | Fixed | |
Assigned to | None | goldsimon | |||
Open/Closed | Open | Closed | |||
2013-06-28 | greg | Attached File | - | Added fragfix, #28446 | |
2013-06-28 | greg | Attached File | - | Added fragloop, #28445 | |
2013-01-31 | sydnash | Attached File | - | Added ip_frag.c, #27354 |
Powered by Savane 3.13-02a9.
Corresponding source code
Fixed, thanks for the patch, Greg.