lwIP - A Lightweight TCP/IP stack - Bugs: bug #57377, Assertion "pbuf_free:...
You are not allowed to post comments on this tracker with your current authentication level.
bug #57377: Assertion "pbuf_free: p->ref > 0" failed
Submitter: | Hiromasa Ito <vhertz> | ||
Submitted: | Sat 07 Dec 2019 01:17:27 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | Fixed |
Privacy: | Public | Assigned to: | yarrick |
Open/Closed: | Closed | Planned Release: | None |
lwIP version: | Other |
Jump to the original submission
Sun 21 Jun 2020 08:28:59 PM UTC, comment #7: |
Erik Ekman <yarrick> |
Sun 21 Jun 2020 08:19:15 PM UTC, comment #6: I did not write it here, but setting the LWIP_RAND_FOR_FUZZ_SIMULATE_GLIBC define allows LWIP_RAND_FOR_FUZZ to be kept. It will then return the first 20 rand() values which would have been used before with normal LWIP_RAND. |
Erik Ekman <yarrick> |
Sun 21 Jun 2020 01:25:51 PM UTC, comment #5:
As far as I know, my test driver is merged, refactored, and improved by Simon (@goldsimon). As a result of the process of them, some crashes I reported seem to become unreproducible.
|
Hiromasa Ito <vhertz> |
Fri 19 Jun 2020 01:40:38 PM UTC, comment #4: |
Erik Ekman <yarrick> |
Fri 19 Jun 2020 12:55:35 PM UTC, comment #3: I agree that this looks like a double free.
|
Erik Ekman <yarrick> |
Fri 19 Jun 2020 11:14:22 AM UTC, comment #2: By disabling LWIP_RAND_FOR_FUZZ I got some of them to fail:
|
Erik Ekman <yarrick> |
Fri 19 Jun 2020 11:03:27 AM UTC, comment #1: I tried rebasing your lwIP patch to run with the latest code, see attachment. For me all the crashed_input files work when I try them. Did I miss something or did some other fuzz setting change?
|
Erik Ekman <yarrick> |
Sat 07 Dec 2019 01:17:27 PM UTC, original submission:
Hi, all.
|
Hiromasa Ito <vhertz> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 5 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2020-06-19 | yarrick | Status | None | Fixed | |
Assigned to | None | yarrick | |||
Open/Closed | Open | Closed | |||
2020-06-19 | yarrick | Attached File | - | Added triple_fuzz.patch, #49312 | |
Attached File | - | Added crashed_inputs.tgz, #49313 |
Powered by Savane 3.13-758e.
Corresponding source code
Using latest git code:
$ cd test/fuzz
$ make all D="-DLWIP_RAND_FOR_FUZZ_SIMULATE_GLIBC"
$ for i in `ls crashed_inputs/*`; do ./lwip_fuzz3 $i; done
reading input from file... testing file: "crashed_inputs/001"...
reading input from file... testing file: "crashed_inputs/002"...
reading input from file... testing file: "crashed_inputs/003"...
reading input from file... testing file: "crashed_inputs/004"...
Assertion "mss_local is too small" failed at line 486 in ../../src/core/tcp_out.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/005"...
Assertion "inconsistent oversize vs. space" failed at line 504 in ../../src/core/tcp_out.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/006"...
reading input from file... testing file: "crashed_inputs/007"...
Assertion "tcp_slowtimr: persist ticking with empty send buffer" failed at line 1241 in ../../src/core/tcp.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/008"...
Assertion "Can't split segment into length 0" failed at line 851 in ../../src/core/tcp_out.c
Aborted (core dumped)
reading input from file... testing file: "crashed_inputs/009"...
So after this one was fixed (006) there are still 4 left that crash. I am not familiar with the tcp code so I am not sure if I can fix them.