buglwIP - A Lightweight TCP/IP stack - Bugs: bug #42138, pppOverEthernetClose() may meet an...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #42138: pppOverEthernetClose() may meet an error of "if statement condition"

Submitter:  yanyafei <yanyafei>
Submitted:  Fri 18 Apr 2014 05:41:13 AM UTC
   
 
Category:  PPP Severity:  5 - Blocker
Item Group:  Faulty Behaviour Status:  Fixed
Privacy:  Public Assigned to:  gradator
Open/Closed:  Closed Planned Release:  None
lwIP version:  1.4.1

Thu 22 May 2014 07:37:04 PM UTC, comment #2: 

ppp-new branch merged in master

Sylvain Rochet <gradator>
Group Member
Sat 19 Apr 2014 09:56:39 PM UTC, comment #1: 

Oh dear, this is a quite a huge bug, it renders PPPoE totally unusable with the current master branch. This confirm the fact that no one is currently using the PPPoE support. I wonder how I managed to didn't catch this one earlier.

The ppp-new branch is less impacted because we only destroy the PPPoE control block if the PPP interface is destroyed which almost never happen since we are using persistent PPP interface.

Anyway, this is fixed in the ppp-new branch. The patch can probably be easily backported to the current master branch.

Thank for the report ! :)

Sylvain

Sylvain Rochet <gradator>
Group Member
Fri 18 Apr 2014 05:41:13 AM UTC, original submission:  

Hi,I place the doubtful code snippet follwoing:
void
pppOverEthernetClose(int pd)
{
  PPPControl* pc = &pppControl[pd];

  /* TJL There's no lcp_deinit */
  lcp_close(pd, NULL);

  pppoe_destroy(&pc->netif);
}

pppoe_destroy(struct netif *ifp)
{
  struct pppoe_softc *sc, *prev = NULL;

  for (sc = pppoe_softc_list; sc != NULL; prev = sc, sc = sc->next) {
    if (sc->sc_ethif == ifp) {
      break;
    }
  }
  if(!(sc && (sc->sc_ethif == ifp))) {
    return ERR_IF;
  }
  ....
  ....
  ....


I have some problem about the invocation at "pppoe_destroy(&pc->netif)",you see this parameter "&pc->netif" which indicates a virtual PPP network device interface in LwIP, however, in function pppoe_detroy(), a ethernet network device interface "sc->sc_ethif" compares with a PPP network device interface at this line of the code " if (sc->sc_ethif == ifp)", so when it beaks the "for" loop, "sc" will be NULL, and it will return ERR_IF immediately. Finally, the PPPOE memory never free.

yanyafei <yanyafei>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gradator (Posted a comment)
  • -email is unavailable- added by yanyafei (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-22 gradator Open/ClosedOpen Closed
        Planned Release 1.5.0
    2014-04-19 gradator Severity3 - Normal 5 - Blocker
        StatusNone Fixed
        Assigned toNone gradator

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code