buglwIP - A Lightweight TCP/IP stack - Bugs: bug #52676, tcp: pcb->unsent_oversize not...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52676: tcp: pcb->unsent_oversize not cleared segment split leading to memory corruption

Submitted by:  Joel Cunningham <jcunningham>
Submitted on:  Fri 15 Dec 2017 06:32:28 PM UTC  
 
Category: TCPSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Joel Cunningham <jcunningham>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Mon 18 Dec 2017 05:48:28 PM UTC, comment #3:

Updated patch also handling useg->oversize_left is committed in 50a5d85f458f675165fabf0c2ced7c1e6dd2ae1c

Joel Cunningham <jcunningham>
Project MemberIn charge of this item.
Mon 18 Dec 2017 02:57:39 PM UTC, comment #2:

> I wonder if we additionally need to reset unsent_oversize of one of the segments though.


Good point, I'll add support for handling the per segment tracking as well

Joel Cunningham <jcunningham>
Project MemberIn charge of this item.
Sat 16 Dec 2017 01:31:19 PM UTC, comment #1:

Oversize works at 2 places: pcb and segment (although the latter one only if TCP_OVERSIZE_DBGCHECK==1).

You set the pcb member 'unsent_oversize' to 0, which looks correct. I wonder if we additionally need to reset unsent_oversize of one of the segments though.

Simon Goldschmidt <goldsimon>
Project Administrator
Fri 15 Dec 2017 06:32:28 PM UTC, original submission:

I found a bug in tcp_split_unsent_seg() where if there is a single oversized segment being split, pcb->unsent_oversize is not cleared, leading to memory corruption if tcp_write is called before the remainder of the split is sent via tcp_output().

Just as a refresher, the split is accomplished by calling pbuf_realloc() on the head to shrink it to the split size, then a new pbuf (of exact size) is allocated for the remainder and added after the head.

I updated the test_tcp_persist_split unit test to explicitly check for this case.

Just wanted a RFC on this fix before pushing it. I haven't worked as much with the oversize feature, so I wanted to make sure I have a correct understanding

Joel Cunningham <jcunningham>
Project MemberIn charge of this item.

 

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by jcunningham (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 18 Dec 2017 05:48:28 PM UTCjcunninghamStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Fri 15 Dec 2017 06:32:28 PM UTCjcunninghamAttached File-=>Added 0001-tcp-clear-unsent_oversize-during-segment-split.patch, #42658

    Back to the top


    Powered by Savane 3.1-cleanup1