buglwIP - A Lightweight TCP/IP stack - Bugs: bug #46471, lwip_accept() leaks socket...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46471: lwip_accept() leaks socket descriptors if new netconn was already closed because of peer behavior

Submitted by:  Kerem Hadimli <keremhadimli>
Submitted on:  Wed 18 Nov 2015 10:49:23 AM UTC  
 
Category: sockets/netconnSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Thu 19 Nov 2015 06:35:31 AM UTC, comment #2:

D'oh! I've messed up the committer/comment, sorry.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Thu 19 Nov 2015 06:34:43 AM UTC, comment #1:

Fixed, thanks for the patch.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 18 Nov 2015 10:49:23 AM UTC, original submission:

A few commits behind LwIP master, we see this with a sequence like:

- A host sends a SYN to LwIP device
- LwIP device SYN-ACKs the host, creates the netconn in established/establishing state, posts it to accept mbox
- Host responds with RST (the whole sequence takes over 10 seconds while our device was watchdog-rebooting)
- LwIP marks the netconn as closed
- lwip_accept() is called on socket layer, it fetches the netconn object from accept mbox
- lwip_accept() allocates a socket number to it. sockets[newsock]->conn == new_netconn
- lwip_accept() tries to get the address of the peer. netconn_peer() returns error -11 (ERR_CONN not connected)
- lwip_accept() calls "netconn_delete(newconn);", and returns -1. Socket is still pointing to that pointer.
- Next connection attempts re-use the pointer because of memory pooling, then multiple socket descriptors point to the same netconn pointer
- eventually socket descriptors run out, and no more TCP connections can be accepted

A patch is attached.

Kerem Hadimli <keremhadimli>

 

Attached Files
file #35495:  lwip_socket_accept_descriptor_leak_simpler.diff added by keremhadimli (692B - application/octet-stream - A simpler fix is attached.)
file #35493:  lwip_socket_accept_descriptor_leak.diff added by keremhadimli (957B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by keremhadimli (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 19 Nov 2015 06:34:43 AM UTCgoldsimonStatusNone=>Fixed
      Assigned toNone=>goldsimon
      Open/ClosedOpen=>Closed
    Wed 18 Nov 2015 11:06:08 AM UTCkeremhadimliAttached File-=>Added lwip_socket_accept_descriptor_leak_simpler.diff, #35495
    Wed 18 Nov 2015 10:49:23 AM UTCkeremhadimliAttached File-=>Added lwip_socket_accept_descriptor_leak.diff, #35493

    Back to the top


    Powered by Savane 3.1-cleanup1