buglwIP - A Lightweight TCP/IP stack - Bugs: bug #49328, Crash error in ip6_frag due to...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #49328: Crash error in ip6_frag due to Assertion Fail

Submitted by:  Arpit Agarwal <arpit_iitg>
Submitted on:  Thu 13 Oct 2016 04:39:39 AM UTC  
 
Category: IPv6Severity: 3 - Normal
Item Group: Crash ErrorStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Thu 13 Oct 2016 06:27:45 PM UTC, comment #3:

Yes, its actually duplicated code. But I guess it is OK to have this assert right before accessing the date that needs to be contiguous. Maybe this function is called from elsewhere in the future, or the assert in the calling function is removed by for reason.

Dirk Ziegelmeier <dziegel>
Project Member
Thu 13 Oct 2016 01:30:27 PM UTC, comment #2:

Hi Dirk,

If so, then isn't this condition redundant as the same check is already performed in ip_output_if before calling ip6_frag (if required).

Here is the check(Line # 848, Func- ip_output_if, file: ip6.c):

LWIP_ASSERT("check that first pbuf can hold struct ip6_hdr",
(p->len >= sizeof(struct ip6_hdr)));

Arpit Agarwal <arpit_iitg>
Thu 13 Oct 2016 06:53:28 AM UTC, comment #1:

The returned rambuf is contiguous, so it is always of length >= IP6_HLEN + IP6_FRAG_HLEN. The assertion meant to check the incoming pbuf, since its payload is copied via SMEMCPY, and this only works if the incoming pbuf is contiguous. But only IP6_HLEN is copied, so checking for "IP6_HLEN + IP6_FRAG_HLEN" instead of only IP6_HLEN was wrong.

Thanks for reporting!

Dirk Ziegelmeier <dziegel>
Project Member
Thu 13 Oct 2016 04:39:39 AM UTC, original submission:

There is a crash error observed in ip6_frag API due to following Assert fail:

rambuf = pbuf_alloc(PBUF_LINK, IP6_HLEN + IP6_FRAG_HLEN, PBUF_RAM);
if (rambuf == NULL) {
IP6_FRAG_STATS_INC(ip6_frag.memerr);
return ERR_MEM;
}
LWIP_ASSERT("this needs a pbuf in one piece!",
(p->len >= (IP6_HLEN + IP6_FRAG_HLEN)));

The scenario occurs when I try to use raw_sendto to send a ping6 packet.

I think the check in assertion is wrong. We should check rambuf->len and not p->len as in the raw_sendto scenario p->len will be just IP6 Header len.

I locally tried modifying the assert check, and that works properly.

Arpit Agarwal <arpit_iitg>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by dziegel (Posted a comment)
  • -unavailable- added by arpit_iitg (Submitted the item)
  • -unavailable- added by arpit_iitg
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 13 Oct 2016 06:53:28 AM UTCdziegelStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Thu 13 Oct 2016 04:39:39 AM UTCarpit_iitgCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1