buglwIP - A Lightweight TCP/IP stack - Bugs: bug #31903, Calling lwip_shutdown() followed...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #31903: Calling lwip_shutdown() followed by lwip_close() causes a null pointer deference

Submitted by:  Brad Plant <bplant>
Submitted on:  Fri 17 Dec 2010 08:31:58 AM UTC  
 
Category: sockets/netconnSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Works For Me
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: 1.3.0

(Jump to the original submission Jump to the original submission)

Sun 27 Mar 2011 12:42:23 PM UTC, comment #6:

I've tested this with CVS head and can't find a problem. Please reopen if you do have problems with this under 1.4.0 (or above).

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 23 Mar 2011 06:53:05 AM UTC, comment #5:

A very good chance I would think. I've since upgraded to 1.3.2. Is it only fixed in 1.4? Looks like that's still in rc?

Brad Plant <bplant>
Wed 23 Mar 2011 06:14:08 AM UTC, comment #4:

OK, in that case, I'm sorry I closed the bug too early. I'll see if I can try calling the 2 functions myself later today.

However, there's a good chance this is already fixed since lwip_shutdown() has been correctly implemented and I think lwip_close() has been fundamentally changed since 1.3.0, too.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 22 Mar 2011 09:11:07 PM UTC, comment #3:

lwip_shutdown() and lwip_close() were called from the same thread. The call to lwip_close() immediately followed the call to lwip_shutdown() so maybe there was a race condition?

Brad Plant <bplant>
Tue 22 Mar 2011 08:44:19 PM UTC, comment #2:

Please correct me (and re-open) if I'm wrong, but from the original post, this bug report is invalid. There's no such thing as "the second call might try and post to a mailbox just after netconn_free is called by the first call". Things like this can only happen with multiple threads, and the lwIP socket API is not designed to share sockets between threads.

As such, the second call to lwip_close() will return -1 since get_sock() cannot find the socket descriptor.

BTW: You're using an old version of lwIP. lwip_shutdown() is not mapped to lwip_close() any more.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Fri 17 Dec 2010 09:22:47 AM UTC, comment #1:

Note that the problem here is not that lwip_close() being called twice causes a null pointer dereference, it's that we map lwip_shutdown() to lwip_close().

It's not necessary for us to support calling lwip_close() twice. It is necessary for us to support calling lwip_shutdown() followed by lwip_close()

Kieran Mansley <kieranm>
Project Administrator
Fri 17 Dec 2010 08:31:58 AM UTC, original submission:

Calling lwip_close() twice on a socket creates a race condition resulting in a null pointer deference. This issue appears to be that the second call to lwip_close() isn't aware that the socket has already been closed. The second call might try and post to a mailbox just after netconn_free is called by the first call resulting in a null pointer deference.

Yes, code shouldn't be trying to call lwip_close() twice. I am using a third party web server that calls lwip_shutdown and then later calls lwip_close. lwip_shutdown is mapped to lwip_close resulting in 2 calls to lwip_close.

Brad Plant <bplant>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by kieranm (Posted a comment)
  • -unavailable- added by bplant (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 27 Mar 2011 12:42:23 PM UTCgoldsimonStatusIn Progress=>Works For Me
      Open/ClosedOpen=>Closed
    Wed 23 Mar 2011 06:14:08 AM UTCgoldsimonStatusInvalid=>In Progress
      Open/ClosedClosed=>Open
    Tue 22 Mar 2011 08:44:19 PM UTCgoldsimonStatusNone=>Invalid
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Tue 11 Jan 2011 01:54:41 PM UTCkieranmPlanned Release=>1.4.1
    Fri 17 Dec 2010 09:22:47 AM UTCkieranmSummaryCalling lwip_close() twice causes a null pointer deference=>Calling lwip_shutdown() followed by lwip_close() causes a null pointer deference

    Back to the top


    Powered by Savane 3.1-cleanup1