buglwIP - A Lightweight TCP/IP stack - Bugs: bug #27252, Address pointer invalid after...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #27252: Address pointer invalid after freeing pbuf in UDP receive callback

Submitted by:  Ben Hastings <hastings>
Submitted on:  Fri 14 Aug 2009 03:18:44 PM UTC  
 
Category: UDPSeverity: 3 - Normal
Item Group: Change RequestStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: CVS Head

Wed 07 Oct 2009 05:51:43 PM UTC, comment #5:

Fixed by reverting to the code before and adding a warning at the recv-callback definition in struct udp_pcb.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Sat 03 Oct 2009 06:19:28 PM UTC, comment #4:

I'll fix this for 1.3.2.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 15 Sep 2009 05:31:13 PM UTC, comment #3:

The workaround (making a local copy of the address) isn't difficult and should only be necessary if the user code frees the incoming pbuf before sending out a response. Would it make more sense to document the behavior than to change the code?

Ben Hastings <hastings>
Sun 30 Aug 2009 09:06:15 PM UTC, comment #2:

Uhm, seems like I missed one thing here: netbufs don't copy the address but only the pointer to the address, which collides with this change because as it is now, the address doesn't survive the thread change from tcpip_thread to the application thread where the netbuf is used.

Personally, I'd favour changing the struct netbuf to include a struct ip_addr instead of its pointer.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Sun 23 Aug 2009 11:33:18 AM UTC, comment #1:

Fixed by copying the address to the stack before calling the recv callback function.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 14 Aug 2009 03:18:44 PM UTC, original submission:

After the pbuf is freed in the UDP receive callback, the address pointer passed to the function may no longer be valid.

--- From lwip-users ---

Ben Hastings wrote:

> On a side note, what happens if the pbuf is freed before the end of
> the callback? Does that also free the memory that the address pointer
> points to?
>


That's a good point. Since p->ref is (almost always) == 1 at the point where the pbuf is passed to the receive callback, it will get freed when
pbuf_free(p) is called. I'd still vote for copying the address before calling the receive callback function. It might be a little less performant, but safer.

Simon

Ben Hastings <hastings>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by kieranm (Updated the item)
  • -unavailable- added by hastings (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 07 Oct 2009 05:51:43 PM UTCgoldsimonStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Sat 03 Oct 2009 06:19:28 PM UTCgoldsimonPlanned Release1.4.0=>1.3.2
    Sun 30 Aug 2009 09:06:15 PM UTCgoldsimonStatusFixed=>In Progress
      Open/ClosedClosed=>Open
    Sun 23 Aug 2009 11:33:18 AM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Thu 20 Aug 2009 02:11:33 PM UTCkieranmPlanned Release=>1.4.0

    Back to the top


    Powered by Savane 3.1-cleanup1