buglwIP - A Lightweight TCP/IP stack - Bugs: bug #28049, Keep Alive timeout frees pcb then...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #28049: Keep Alive timeout frees pcb then uses it, sometimes causing crash error.

Submitted by:  Mike <mikeredd>
Submitted on:  Wed 18 Nov 2009 10:24:46 PM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.3.1

Sun 22 Nov 2009 03:45:00 PM UTC, comment #2:

Fixed by calling tcp_rst() instead of tcp_abort() in tcp_slowtmr() when retransmit timer expires.

Thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 20 Nov 2009 05:05:22 PM UTC, comment #1:

The fix would be OK, but I think we might rather change the code to not call tcp_abort at that place:

The keepalive timer is the only timer inside tcp_slowtmr calling tcp_abort, all other timers increase pcb_remove. The difference is mainly that by this, the keepalive timer send directly sends a RST when expiring while the other timers don't.

Is there a reason for this? Kieran maybe?

This is a fairly old bug (has been in there since 1.32 from 6 years ago...).

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 18 Nov 2009 10:24:46 PM UTC, original submission:

Inside of tcp_slowtmr(), when a keepalive timeout occurs, tcp_abort() is called for the pcb. This frees the pcb.

The pcb pointer remains, however, and "pcb = pcb->next" is called at the end of the loop. This causes crash sometimes (because memory can be reallocated during the sending of the RST)and is very tifficult to trace.

Here is a fix (it is also attached):

----- tcp.c (old), line 669 -----

tcp_abort(pcb);

----- tcp.c (new), line 669-672 -----

pcb2 = pcb->next;
tcp_abort(pcb);
pcb = pcb2;
continue;

-----

Mike <mikeredd>

 

Attached Files
file #19079:  tcp.c added by mikeredd (42KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by kieranm (Updated the item)
  • -unavailable- added by mikeredd (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 22 Nov 2009 03:45:00 PM UTCgoldsimonAssigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
      StatusNeed Info=>Fixed
    Fri 20 Nov 2009 05:05:22 PM UTCgoldsimonStatusNone=>Need Info
    Thu 19 Nov 2009 08:59:59 AM UTCkieranmPlanned Release=>1.3.2
    Wed 18 Nov 2009 10:24:46 PM UTCmikereddAttached File-=>Added tcp.c, #19079

    Back to the top


    Powered by Savane 3.1-cleanup1