buglwIP - A Lightweight TCP/IP stack - Bugs: bug #49328, Crash error in ip6_frag due to...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #49328: Crash error in ip6_frag due to Assertion Fail

Submitter:  Arpit Agarwal <arpit_iitg>
Submitted:  Thu 13 Oct 2016 04:39:39 AM UTC
   
 
Category:  IPv6 Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Thu 13 Oct 2016 06:27:45 PM UTC, comment #3: 

Yes, its actually duplicated code. But I guess it is OK to have this assert right before accessing the date that needs to be contiguous. Maybe this function is called from elsewhere in the future, or the assert in the calling function is removed by for reason.

Dirk Ziegelmeier <dziegel>
Group administrator
Thu 13 Oct 2016 01:30:27 PM UTC, comment #2: 

Hi Dirk,

If so, then isn't this condition redundant as the same check is already performed in ip_output_if before calling ip6_frag (if required).

Here is the check(Line # 848, Func- ip_output_if, file: ip6.c):

 LWIP_ASSERT("check that first pbuf can hold struct ip6_hdr",
               (p->len >= sizeof(struct ip6_hdr)));

Arpit Agarwal <arpit_iitg>
Thu 13 Oct 2016 06:53:28 AM UTC, comment #1: 

The returned rambuf is contiguous, so it is always of length >= IP6_HLEN + IP6_FRAG_HLEN. The assertion meant to check the incoming pbuf, since its payload is copied via SMEMCPY, and this only works if the incoming pbuf is contiguous. But only IP6_HLEN is copied, so checking for "IP6_HLEN + IP6_FRAG_HLEN" instead of only IP6_HLEN was wrong.

Thanks for reporting!

Dirk Ziegelmeier <dziegel>
Group administrator
Thu 13 Oct 2016 04:39:39 AM UTC, original submission:  

There is a crash error observed in ip6_frag API due to following Assert fail:

rambuf = pbuf_alloc(PBUF_LINK, IP6_HLEN + IP6_FRAG_HLEN, PBUF_RAM);
    if (rambuf == NULL) {
      IP6_FRAG_STATS_INC(ip6_frag.memerr);
      return ERR_MEM;
    }
    LWIP_ASSERT("this needs a pbuf in one piece!",
                (p->len >= (IP6_HLEN + IP6_FRAG_HLEN)));

The scenario occurs when I try to use raw_sendto to send a ping6 packet.

I think the check in assertion is wrong. We should check rambuf->len and not p->len as in the raw_sendto scenario p->len will be just IP6 Header len.

I locally tried modifying the assert check, and that works properly.

Arpit Agarwal <arpit_iitg>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by arpit_iitg (Submitted the item)
  • -email is unavailable- added by arpit_iitg
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-10-13 dziegel StatusNone Fixed
        Open/ClosedOpen Closed
    2016-10-13 arpit_iitg Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code