lwIP - A Lightweight TCP/IP stack - Bugs: bug #48543, TCP sent callback may prematurely...
You are not allowed to post comments on this tracker with your current authentication level.
bug #48543: TCP sent callback may prematurely report sent data when only part of a segment is acked
Submitter: | Ambroz Bizjak <abizjak> | ||
Submitted: | Sun 17 Jul 2016 02:20:30 PM UTC | ||
Category: | TCP | Severity: | 2 - Minor |
Item Group: | Faulty Behaviour | Status: | Fixed |
Privacy: | Public | Assigned to: | goldsimon |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | git head |
Jump to the original submission
Thu 21 Jul 2016 12:06:13 PM UTC, comment #7: |
Simon Goldschmidt <goldsimon> |
Tue 19 Jul 2016 08:22:17 PM UTC, comment #6:
|
Simon Goldschmidt <goldsimon> |
Tue 19 Jul 2016 08:11:07 PM UTC, comment #5: I suppose there are some situations which could lead to a crash. Say the segment is composed of multiple chained pbufs (due to multiple tcp_write calls), and the application free()s the buffer referenced by the first pbuf since the data has supposedly been acked. But lwip then tries to retransmit the whole segment. On a platform with a free() that works with paging / virtual memory, the freed data might actually become inaccessible causing a crash. |
Ambroz Bizjak <abizjak> |
Tue 19 Jul 2016 08:04:54 PM UTC, comment #4: While a retransmission might still use data in question, a remote TCP should not care if it changes (since it has already ACKed the bytes in question).
|
Simon Goldschmidt <goldsimon> |
Tue 19 Jul 2016 05:54:45 PM UTC, comment #3: Here, I've implemented a fix in my fork: https://github.com/ambrop72/aprinter/commit/a4f6315b4822a25a01a652ff8e162a1839b29d67
|
Ambroz Bizjak <abizjak> |
Tue 19 Jul 2016 04:53:29 PM UTC, comment #2: Hi Simon,
|
Ambroz Bizjak <abizjak> |
Tue 19 Jul 2016 10:48:11 AM UTC, comment #1: I don't think I get the problem: the 'sent' callback is called with the number of bytes acked (actually, the difference between 'lastack' and the 'ackno' of the received segment.
|
Simon Goldschmidt <goldsimon> |
Sun 17 Jul 2016 02:20:30 PM UTC, original submission:
Suppose the application is using tcp_write() without TCP_WRITE_FLAG_COPY to send data directly from a buffer. In this case it needs to carefully monitor the tcp_sndbuf and/or rely on the sent callback to see when it may reuse old buffers.
|
Ambroz Bizjak <abizjak> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 6 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2016-07-21 | goldsimon | Status | Confirmed | Fixed | |
Assigned to | None | goldsimon | |||
Open/Closed | Open | Closed | |||
2016-07-19 | goldsimon | Severity | 3 - Normal | 2 - Minor | |
Status | Works For Me | Confirmed | |||
2016-07-19 | goldsimon | Status | None | Works For Me |
Powered by Savane 3.13-aa77.
Corresponding source code
Bug fixed, thanks for reporting.
Combining the ACKed segment check for the 2 lists is a good idea as well...