buglwIP - A Lightweight TCP/IP stack - Bugs: bug #52112, Unavoidable hazards when calling...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52112: Unavoidable hazards when calling tcp_close from callback

Submitter:  Ambroz Bizjak <abizjak>
Submitted:  Mon 25 Sep 2017 06:39:05 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Mon 25 Sep 2017 07:24:52 PM UTC, comment #3: 

This has indeed been buggy with older releases.

Simon Goldschmidt <goldsimon>
Group administrator
Mon 25 Sep 2017 07:22:17 PM UTC, comment #2: 

Please close this, I don't seem to be able to.

Ambroz Bizjak <abizjak>
Mon 25 Sep 2017 07:21:01 PM UTC, comment #1: 

I see that lwIP avoids freeing the PCB from tcp_close when called from tcp_input, so the correct approach is to return ERR_ABRT if and only if the application called tcp_abort. I must have seen the "tcp_close freeing PCB" issue with an older lwIP version and chose to return ERR_ABRT whenever I called tcp_close and this became broken with newer lwIP.

Ambroz Bizjak <abizjak>
Mon 25 Sep 2017 06:39:05 PM UTC, original submission:  

Consider an application calling tcp_close from one of the PCB callbacks, where tcp_close succeeds. In this case the application can either return ERR_ABRT or not. It seems to me that either way things break.

- If the application does not return ERR_ABRT: There are cases where tcp_close frees the PCB, but since the callback does not return ERR_ABRT, lwIP will try to access the freed PCB.

- If the application returns ERR_ABRT: Consider the case where tcp_close_shutdown called tcp_trigger_input_pcb_close(), having removed the PCB from tcp_active pcbs but not freeing it. Since the callback returned ERR_ABRT, tcp_input_delayed_close() is inhibited and the PCB is leaked.

My application is currently taking the second approach and I am seeing leaked PCBs. I have not proven this is the same leak but I see no other way for a PCB to be leaked.

Ambroz Bizjak <abizjak>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dziegel (Updated the item)
  • -email is unavailable- added by abizjak (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-09-25 goldsimon StatusInvalid None
    2017-09-25 dziegel StatusNone Invalid
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code