buglwIP - A Lightweight TCP/IP stack - Bugs: bug #28562, Segfault @ err_tcp

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #28562: Segfault @ err_tcp

Submitted by:  Homyak <onlyslon>
Submitted on:  Tue 12 Jan 2010 11:47:47 AM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: CVS Head

(Jump to the original submission Jump to the original submission)

Sat 23 Jan 2010 03:06:14 PM UTC, comment #9:

Closing since fixed with the last comment already

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 14 Jan 2010 03:43:47 PM UTC, comment #8:

I think the cause rather might be 'conn->pcb.tcp = NULL;' in err_tcp(), because the one in netconn_delete() is executed after do_delconn() (which in turn executes netconn_drain()).

Anyway, I didn't think the pcb might be null here, which it can (due to err_tcp), so I've included an if(!=NULL) around the calls, which should solve the problem.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 14 Jan 2010 03:35:42 PM UTC, comment #7:

little more info

TCP thread
[Switching to thread 1 (Thread 28899)]#0 0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
447 pcb->rcv_wnd += len;
(gdb) bt
#0 0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
#1 0x0808f003 in netconn_drain (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
#2 0x0808f266 in do_delconn (msg=0xb4e7a388) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:712
#3 0x08061dfa in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:100
(gdb) up
#1 0x0808f003 in netconn_drain (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
622 tcp_recved(conn->pcb.tcp, p->tot_len);
(gdb) p *conn
$2 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x89a7108, recvmbox = 0x0,
acceptmbox = 0x0, socket = 9, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 438, write_msg = 0x0, write_offset = 0,
callback = 0x806e691 <sx3g_event_callback>}

TCP READ_THREAD
----------------------------------
(gdb) bt
#0 0xb7f09410 in ?? ()
#1 0x0806413d in cond_wait (cond=0x89a710c, mutex=0x89a713c, timeout=0) at lwip/cvs/contrib/ports/unix/sys_arch.c:635
#2 0x080641cf in sys_arch_sem_wait (sem=0x89a7108, timeout=0) at lwip/cvs/contrib/ports/unix/sys_arch.c:662
#3 0x08062157 in tcpip_apimsg (apimsg=0xb4e7a384) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:289
#4 0x0808df6e in netconn_delete (conn=0x8262298) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#5 0x0806bbc4 in lwip_socket_close (s=9) at sockets.c:421
#6 0x0806a063 in tcp_read_thread (arg=0x88360e8) at tcp_handlers.c:408

Possibly cause

conn->pcb.tcp = NULL; at netconn_delete @ api_lib.c

Homyak <onlyslon>
Thu 14 Jan 2010 03:10:40 PM UTC, comment #6:

I got segfault again 8-(

it look like this....
(gdb) bt
#0 0x0805d4e4 in tcp_recved (pcb=0x0, len=438) at lwip/cvs/contrib/../lwip/src/core/tcp.c:447
#1 0x0808f003 in netconn_drain (conn=0x8262234) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:622
#2 0x0808f266 in do_delconn (msg=0xb4e7a388) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:712
#3 0x08061dfa in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:100
#4 0xb7a50240 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5 0xb7e1c4ae in clone () from /lib/tls/i686/cmov/libc.so.6

Homyak <onlyslon>
Thu 14 Jan 2010 01:27:24 PM UTC, comment #5:

Segfault no longer occurs.
Thanks Simon.

Homyak <onlyslon>
Wed 13 Jan 2010 04:00:29 PM UTC, comment #4:

Fixed. Homyak, can you verify it works?

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 12 Jan 2010 06:30:41 PM UTC, comment #3:

Yes, it's a result of fixing bug #26672, which I did just four days ago.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 12 Jan 2010 04:18:14 PM UTC, comment #2:

Can I check that this was introduced after 1.3.2?

Kieran Mansley <kieranm>
Project Administrator
Tue 12 Jan 2010 03:32:18 PM UTC, comment #1:

Thanks for the excellent report! I don't know where I had my mind when writing that code, but setting recvmbox/acceptmbox to SYS_MBOX_NULL from the application thread is of course wrong and the source of this bug.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 12 Jan 2010 11:47:47 AM UTC, original submission:

Have 2 threads. - tcp/ip thread & tcp read thread.

it look like lwip bug, but Im not sure. Please fix me if I mistaken

Thanks.

Ok. I just have segfault sometimes

TCP thread backtrace -
------------------------------------
#0 0x08063b10 in sys_mbox_post (mbox=0x0, msg=0x0) at lwip/cvs/contrib/ports/unix/sys_arch.c:372
#1 0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
#2 0x0808a7d1 in tcp_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/tcp_in.c:313
#3 0x08060db7 in ip_input (p=0x85f1c60, inp=0x88363f4) at lwip/cvs/contrib/../lwip/src/core/ipv4/ip.c:417
#4 0x08061e3c in tcpip_thread (arg=0x0) at lwip/cvs/contrib/../lwip/src/api/tcpip.c:111
#5 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#6 0xb7e523ae in clone () from /lib/libc.so.6
(gdb) up
#1 0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
322 sys_mbox_post(conn->recvmbox, NULL);
(gdb) p *conn
$4 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0, udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x899e998, recvmbox = 0x0,
acceptmbox = 0x0, socket = 2, recv_timeout = 1000, recv_bufsize = 2147483647, recv_avail = 0, write_msg = 0x0, write_offset = 0,
callback = 0x806e77d <sx3g_event_callback>}

READER thread backtrace
(gdb) bt
#2 0xb7e5eb84 in pthread_cond_timedwait () from /lib/libc.so.6
#3 0x08064138 in cond_wait (cond=0x89db07c, mutex=0x89db0ac, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:617
#4 0x08064223 in sys_arch_sem_wait (sem=0x89db078, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:650
#5 0x08063d58 in sys_arch_mbox_fetch (mbox=0x8abb148, msg=0xb4f04298, timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:476
#6 0x0808efe3 in netconn_drain (conn=0x826216c, bytes_drained=0xb4f042d0, accepts_drained=0xb4f042ce) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:624
#7 0x0808dec7 in netconn_delete (conn=0x826216c) at lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#8 0x0806bcb0 in lwip_close (s=2) at sockets.c:421
#9 0x0806a14f in tcp_read_thread (arg=0x8836328) at tcp_handlers.c:408
#10 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#11 0xb7e523ae in clone () from /lib/libc.so.6

Situation -
- we got RST from remote side
- tcp/ip thread call err_tcp
@api_msg.c line 319

if (conn->recvmbox != SYS_MBOX_NULL) {
/* Register event with callback */
API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0);
sys_mbox_post(conn->recvmbox, NULL);
}

- After API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0); TCP read thread got waked and start trying read from socket and cause lwip_read returned - 0 bytes - trying to close socket

- First all lwip_close call netconn_delete -> netconn_drain
netconn_drain set recvmbox to SYS_MBOX_NULL and after switch context to tcp/ip thread we got segfault at sys_mbox_post(conn->recvmbox, NULL); cause recvmbox = NULL

Plsease fix me if I wrong.

Homyak <onlyslon>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kieranm (Posted a comment)
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by onlyslon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 23 Jan 2010 03:06:14 PM UTCgoldsimonOpen/ClosedOpen=>Closed
    Wed 13 Jan 2010 04:00:29 PM UTCgoldsimonStatusConfirmed=>Fixed
    Tue 12 Jan 2010 03:32:18 PM UTCgoldsimonStatusNone=>Confirmed
      Assigned toNone=>goldsimon

    Back to the top


    Powered by Savane 3.1-cleanup1