buglwIP - A Lightweight TCP/IP stack - Bugs: bug #24440, TCP connection close problem on...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #24440: TCP connection close problem on 64-bit host

Submitted by:  David Woodhouse <dwmw2>
Submitted on:  Fri 03 Oct 2008 01:19:22 PM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: CVS Head

Mon 16 Feb 2009 04:51:42 PM UTC, comment #3:

Fixed.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 11 Feb 2009 06:55:34 PM UTC, comment #2:

> there's no need for an accept callback entry on a struct tcp_pcb


I'm afraid there is: when a new connection is opened by a listening pcb, the accept pointer is copied to the new tcp_pcb. The reason is the callback is only called after the ACK for the SYN is received from the remote host.

> tcp_accept() should take a struct tcp_pcb_listen type


But we need to reset the accept pointer for a normal pcb, too. I guess a better fix would be to move accept into TCP_PCB_COMMON so that it is the same for both tcp pcb types.

An even better fix would be to change the *_PCB_COMMON/IP_PCB defines to aggregating other structs so that we are safe from compilers that change the layout of structs, but that could well be another discussion...

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 03 Oct 2008 01:25:00 PM UTC, comment #1:

A safe work-around would be to prefix the call to tcp_accept in do_listen_internal() with:

if (pcb->state == LISTEN)

I think. I've not tried this though.

To fix properly needs a little bit of work though - there's some cleaning up that can be done (there's no need for an accept callback entry on a struct tcp_pcb) and tcp_accept() should take a struct tcp_pcb_listen type.

Kieran Mansley <kieranm>
Project Administrator
Fri 03 Oct 2008 01:19:22 PM UTC, original submission:

When I build the simhost project for x86_64 Linux, telnet into it and type 'quit', I see bogus ACK numbers in the resulting fin packets.

It looks like pcb->rcv_nxt is being scribbled on by tcp_accept(), which is called from do_close_internal() and casts its argument to some other kind of structure.

tcp_output_segment, pcb 0x629730, pcb->rcv_nxt (at 0x629760) is 6566caf6
quit
Closed
tcp_accept: tcp_pcb 0x629730, accept (nil). Set pcb->accept at 0x629760
tcp_output_segment, pcb 0x629730, pcb->rcv_nxt (at 0x629760) is 0

Catching it in the act in gdb...

Hardware watchpoint 2: (int ) 6461504

Old value = -2094160047
New value = 0
tcp_accept (pcb=0x629810, accept=0)
at ../../../../../lwip/src/core/tcp.c:1118
1118 }
(gdb) bt
#0 tcp_accept (pcb=0x629810, accept=0)
at ../../../../../lwip/src/core/tcp.c:1118
#1 0x000000000040f1a0 in do_close_internal (conn=0x62a1c0)
at ../../../../../lwip/src/api/api_msg.c:606
#2 0x000000000040ff1c in do_close (msg=0x445d4018)
at ../../../../../lwip/src/api/api_msg.c:1124
#3 0x0000000000410107 in tcpip_thread (arg=0x0)
at ../../../../../lwip/src/api/tcpip.c:269
#4 0x000000372940729a in start_thread (arg=<value optimized out>)
at pthread_create.c:297
#5 0x00000037288e439d in clone () from /lib64/libc.so.6

David Woodhouse <dwmw2>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by kieranm (Posted a comment)
  • -unavailable- added by dwmw2 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 16 Feb 2009 04:51:42 PM UTCgoldsimonCategoryNone=>TCP
      Item GroupNone=>Crash Error
      StatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1