buglwIP - A Lightweight TCP/IP stack - Bugs: bug #38288, lwip_shutdown followed by...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #38288: lwip_shutdown followed by lwip_close can cause double free of tcp_pcb

Submitter:  Ed Branch <ebranch>
Submitted:  Fri 08 Feb 2013 10:09:22 PM UTC
   
 
Category:  sockets/netconn Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.1

Sat 21 Mar 2015 02:05:32 PM UTC, comment #2: 

This has already been fixed by netconn cleanup in commit ec68aaf43b83c7af1bffbf79cf6ff6444cf79624 on 2015-01-27 21:28.

Thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Fri 08 Feb 2013 11:13:29 PM UTC, comment #1: 

Correction: For the fast connection case the first tcp_shudown call has only shut_rx set. The section should read:

With a fast connection (XGbE), i see:
tcp_shutdown with pcb->state == CLOSE_WAIT, shut_rx == 1, shut_tx == 0
tcp_shutdown with pcb->state == CLOSE_WAIT, shut_rx == 0, shut_tx == 2
memp_free(..., pcb) from tcp_input with pcb->state == CLOSED
tcp_close with pcb->state == CLOSED
memp_free(..., pcb) from tcp_close_shutdown with pcb->state == CLOSED

Ed Branch <ebranch>
Fri 08 Feb 2013 10:09:22 PM UTC, original submission:  

Symtom:
Can manifest as a silent crash or one of several assertion failures, most commonly:

FATAL: ASSERTION FAILED:
tcp_input: pcb->next != pcb (before cache)
in file ../../externals/lwip/src/core/tcp_in.c, at line 182

Can also be detected through heap instrumentation detecting a double free from tcp_close_shutdown().

To reproduce:
On a slow processor with a fast network connection, shutdown both sides of a socket and then close it.
ex.
// open socket, bind, listen, accept, receive, then
shutdown(fd, SHUT_RD);
// send response, then
shutdown(fd, SHUT_WR);
close(fd);

Further information:
The error only occures with a fast network connection. On a slow network connection I see the following sequence in the tcp layer, and all is well:
tcp_shutdown with pcb->state == CLOSE_WAIT, shut_rx == 1, shut_tx == 0
tcp_shutdown with pcb->state == CLOSE_WAIT, shut_rx == 0, shut_tx == 2
tcp_close with pcb->state == LAST_ACK
memp_free(..., pcb) from tcp_input with pcb->state == CLOSED

With a fast connection (XGbE), i see:
tcp_shutdown with pcb->state == CLOSE_WAIT, shut_rx == 1, shut_tx == 1
tcp_shutdown with pcb->state == CLOSE_WAIT, shut_rx == 0, shut_tx == 2
memp_free(..., pcb) from tcp_input with pcb->state == CLOSED
tcp_close with pcb->state == CLOSED
memp_free(..., pcb) from tcp_close_shutdown with pcb->state == CLOSED

The TCP layer seems to initiate deallocation of the tcp_pcb in response to shutdown of both sides, but the socket layer keeps a reference to the pcb (through netconn) until the file descriptor is deallocated by lwip_close(), at which point the possibly already deallocated pcb is closed by netconn_delete().

Ed Branch <ebranch>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by ebranch (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-21 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code