buglwIP - A Lightweight TCP/IP stack - Bugs: bug #13392, The looback interface...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #13392: The looback interface implementation causes reentering the tcp_input function, when BSD api layer is used

Submitted by:  None
Submitted on:  Mon 13 Jun 2005 08:42:26 PM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Duplicate
Privacy: PublicAssigned to: None
Open/Closed: ClosedPlanned Release: None
lwIP version: None

Tue 17 Apr 2007 09:47:01 AM UTC, comment #4:

Closing this as duplicate

see bug #2595 (loopif results in NULL reference for incoming TCP packets) which shows a different result of roughly the same bug.

This bug came from using sys_timeout() in loopif_output() (which generally is a bad solution).
So, this is also a bit dependent on solving bug #1902: 'Timeouts and semaphores/mailboxes are too tightly integrated', but bug #2595 solves this better, so that loopif does not depend on timeouts.

Simon Goldschmidt <goldsimon>
Project Administrator
Mon 26 Feb 2007 01:09:34 PM UTC, comment #3:

Did a patch ever show up? Can I get an update on this one please.

Kieran Mansley <kieranm>
Project Administrator
Sat 25 Nov 2006 10:37:41 AM UTC, comment #2:

I disagree with you that a more generic fix is needed because raw-API does not depend on sys_* functions.

You may attach your patch here, or in the patch manager. Tnx.

Christiaan Simons <christiaans>
Project Member
Tue 14 Jun 2005 08:40:11 AM UTC, comment #1:

Please also notice that the use of sys_sem_wait in the event_callback in socket.c (as described in #13392) may also lead to the situation that both the tcp_timer and tcp_slowtimer can be called before tcp_input finishes. It is yet unclear if this can lead to catastrophic consequences.

Anonymous
Mon 13 Jun 2005 08:42:26 PM UTC, original submission:

I've been porting lwIP on a Trimedia processor and started debugging with making simple TCP echo test on the loopback interface.
To my surprise, numerous memory leaks and assertation faults occured. A deeper investigation revealed that the patch for fixing bug #2595 (based on the use of sys_timeout) causes reentering the tcp_input function via event_callback, which calls the sys_sem_wait function. The latter executes a timeout callback, which starts ip_input and then tcp_input. The following trace, obtained by using the Valgring tool on the unix implementation of the TCP echo test, indicates this problem:

...
==1649== Invalid read of size 2
==1649== at 0x8052936: tcp_input (tcp_in.c:366)
==1649== by 0x8056AC6: ip_input (ip.c:343)
==1649== by 0x8058B3B: loopif_input (loopif.c:57)
==1649== by 0x80506F4: sys_sem_wait (sys.c:147)
==1649== by 0x804CE9C: event_callback (sockets.c:848)
==1649== by 0x804AADD: recv_tcp (api_msg.c:131)
==1649== by 0x805285B: tcp_input (tcp_in.c:336)
==1649== by 0x8056AC6: ip_input (ip.c:343)
==1649== by 0x8058B3B: loopif_input (loopif.c:57)
==1649== by 0x80506F4: sys_sem_wait (sys.c:147)
==1649== by 0x804CE9C: event_callback (sockets.c:848)
==1649== by 0x804AADD: recv_tcp (api_msg.c:131)
==1649== by 0x805285B: tcp_input (tcp_in.c:336)
==1649== by 0x8056AC6: ip_input (ip.c:343)
==1649== by 0x8058B3B: loopif_input (loopif.c:57)
==1649== by 0x8050609: sys_mbox_fetch (sys.c:91)
==1649== by 0x804D87D: tcpip_thread (tcpip.c:103)
==1649== by 0x1B920B62: start_thread (in /lib/tls/libpthread-0.60.so)
==1649== by 0x1BA03C49: clone (in /lib/tls/libc-2.3.2.so)
...

This trace shows the call nesting, which finally leads to reading some unintialized data. It is easy to see that tcp_input gets called three time through the mechanism described above.
To fix this problem, I change the use of sys_timeout to the delivery a message directly to the TCP thread by introducing an additional API message type. This fix however will not work for raw API apprications that which do not use TCP. A more generic fix is needed.

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by kieranm (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 17 Apr 2007 09:47:01 AM UTCgoldsimonStatusNone=>Duplicate
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1