buglwIP - A Lightweight TCP/IP stack - Bugs: bug #48539, Possible crash when packet...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #48539: Possible crash when packet received in SYN_SENT state

Submitter:  Ambroz Bizjak <abizjak>
Submitted:  Sun 17 Jul 2016 09:44:55 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Tue 19 Jul 2016 07:23:57 PM UTC, comment #3: 

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 19 Jul 2016 05:01:48 PM UTC, comment #2: 

Hi Simon,
Just letting you know that in my fork I have refactored the TX code to only use a single queue. That simplifies a bunch of things. Commit: https://github.com/ambrop72/aprinter/commit/372998a262ad729590b3a88f1581022eedd4cd34

Basically I have:
pcb->sndq - the front of the one send queue, always ordered
pcb->sndq_last - last element, removes need to search for the last segment in various places
pcb->sndq_next - next segment to be sent by tcp_output()

For the fast retransmission which used to move a single segment from ->unacked to ->unsent, I just set a flag in pcb->flags which forces tcp_output() to output the first segment in sndq regardless of sndq->next.

As far as this particular issue is concerned, I think it is also an option to check "ackno == (u32_t)(pcb->lastack + 1)" instead of looking at the segments but still care is needed a bit later on when freeing the segment.

Ambroz Bizjak <abizjak>
Tue 19 Jul 2016 10:49:21 AM UTC, comment #1: 

Correct. We have to check "unsent" in this case, too.

Simon Goldschmidt <goldsimon>
Group administrator
Sun 17 Jul 2016 09:44:55 AM UTC, original submission:  

While looking at the code I see a hazard in the tcp_process() SYN_SENT case when accessing pcb->unacked->tcphdr->seqno.

The pcb->unacked could be NULL, I think in the following cases:
(1) tcp_output() in tcp_connect() failed to output the segment; the segment has never been put into unacked.
(2) tcp_output() in tcp_rexmit_rto() failed to output the segment; the segment has been moved back to unsent and stayed there.

Ambroz Bizjak <abizjak>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by abizjak (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-07-19 goldsimon StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2016-07-19 goldsimon StatusNone Confirmed
        Assigned toNone goldsimon

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code