buglwIP - A Lightweight TCP/IP stack - Bugs: bug #26027, Chaining netbufs

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #26027: Chaining netbufs

Submitted by:  Hans-Erik Floryd <hefloryd>
Submitted on:  Fri 27 Mar 2009 01:48:56 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.3.0

Wed 15 Apr 2009 02:57:51 PM UTC, comment #1:

I just wondered who can ever have uses netbuf_chain without a big memory leak?

I've changed it to calling pbuf_cat instead of pbuf_chain so that the second netbuf must not be referenced/freed after passing it to netbuf_chain.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 27 Mar 2009 01:48:56 PM UTC, original submission:

When trying to chain two netbufs (identifier and payload) together, netbuf_chain calls memp_free on the tail. It is unclear if/how the pbuf associated with the tail can then be reclaimed. Test case:

identifier = netbuf_new();
payload = netbuf_new();

netbuf_ref (identifier, pId, pIdSize);
netbuf_ref (payload, pData, pDataSize);
netbuf_chain (identifier, payload);

netconn_sendto (conn, identifier, &addr, port);
netbuf_delete (payload);
netbuf_delete (identifier);

netbuf_chain calls memp_free on the tail (i.e. payload), so when netbuf_delete(payload) is called, payload is no longer valid. On the other hand, if netbuf_delete(payload) is not called, a pbuf is lost because the reference count on the payload data is two, so netbuf_delete(identifier) will not free the data.

Is it correct for netbuf_chain to free the tail netbuf? If that one line is removed the code above works fine.

-unavailable- suggested this in the lwip-users mailing list:
"[...] from reading the code, netbuf_chain should either call netbuf_delete, use pbuf_cat instead of pbuf_chain or don't call memp_free. Which is right I don't know."

Hans-Erik Floryd <hefloryd>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by kieranm (Updated the item)
  • -unavailable- added by hefloryd (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 15 Apr 2009 02:57:51 PM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Fri 03 Apr 2009 10:45:43 AM UTCkieranmPlanned Release=>1.3.1

    Back to the top


    Powered by Savane 3.1-cleanup1