buglwIP - A Lightweight TCP/IP stack - Bugs: bug #48539, Possible crash when packet...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #48539: Possible crash when packet received in SYN_SENT state

Submitted by:  Ambroz Bizjak <abizjak>
Submitted on:  Sun 17 Jul 2016 09:44:55 AM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Tue 19 Jul 2016 07:23:57 PM UTC, comment #3:

Fixed, thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 19 Jul 2016 05:01:48 PM UTC, comment #2:

Hi Simon,
Just letting you know that in my fork I have refactored the TX code to only use a single queue. That simplifies a bunch of things. Commit: https://github.com/ambrop72/aprinter/commit/372998a262ad729590b3a88f1581022eedd4cd34

Basically I have:
pcb->sndq - the front of the one send queue, always ordered
pcb->sndq_last - last element, removes need to search for the last segment in various places
pcb->sndq_next - next segment to be sent by tcp_output()

For the fast retransmission which used to move a single segment from ->unacked to ->unsent, I just set a flag in pcb->flags which forces tcp_output() to output the first segment in sndq regardless of sndq->next.

As far as this particular issue is concerned, I think it is also an option to check "ackno == (u32_t)(pcb->lastack + 1)" instead of looking at the segments but still care is needed a bit later on when freeing the segment.

Ambroz Bizjak <abizjak>
Tue 19 Jul 2016 10:49:21 AM UTC, comment #1:

Correct. We have to check "unsent" in this case, too.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Sun 17 Jul 2016 09:44:55 AM UTC, original submission:

While looking at the code I see a hazard in the tcp_process() SYN_SENT case when accessing pcb->unacked->tcphdr->seqno.

The pcb->unacked could be NULL, I think in the following cases:
(1) tcp_output() in tcp_connect() failed to output the segment; the segment has never been put into unacked.
(2) tcp_output() in tcp_rexmit_rto() failed to output the segment; the segment has been moved back to unsent and stayed there.

Ambroz Bizjak <abizjak>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by abizjak (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 19 Jul 2016 07:23:57 PM UTCgoldsimonStatusConfirmed=>Fixed
      Open/ClosedOpen=>Closed
    Tue 19 Jul 2016 10:49:21 AM UTCgoldsimonStatusNone=>Confirmed
      Assigned toNone=>goldsimon

    Back to the top


    Powered by Savane 3.1-cleanup1