buglwIP - A Lightweight TCP/IP stack - Bugs: bug #56397, Assert "tcp_receive: ooseq...


You are not allowed to post comments on this tracker with your current authentication level.

bug #56397: Assert "tcp_receive: ooseq tcplen > rcv_wnd"

Submitted by:  David GIRAULT <dgirault>
Submitted on:  Mon 27 May 2019 04:01:08 PM UTC  
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  git head

Wed 05 Jun 2019 01:07:58 PM UTC, comment #4: 

That would be great, as I cannot reproduce this either.

BTW: are you using window scaling here? Maybe it has something do to with that...

Simon Goldschmidt <goldsimon>
Project Administrator
Wed 05 Jun 2019 10:13:07 AM UTC, comment #3: 

Sorry, this bug was only in 3 of our customers and I can't reproduce it myself at work.

I may instrument code before the assert to have usefull values in our saved traces sent after reboot but need to wait for the crash occurs again with this new version deployed to impacted customers.

David GIRAULT <dgirault>
Tue 04 Jun 2019 07:07:02 PM UTC, comment #2: 

Hmm, can you reproduce this? If so, could you just add more output? e.g. the values of rcv_wnd and TCP_TCPLEN(cseg). Maybe it's an off-by-one (due to SYN/FIN) or some kind of overflow?

Simon Goldschmidt <goldsimon>
Project Administrator
Tue 28 May 2019 12:08:37 PM UTC, comment #1: 

May be related to bug #29080, fixed by cf0b8319.

This commit should prevent having TCP_TCPLEN(cseg) > pcb->rcv_wnd isn't it?

David GIRAULT <dgirault>
Mon 27 May 2019 04:01:08 PM UTC, original submission:  

I'm just got the following LWIP_ASSERT() at tcp_in.c:1582 (current master: b3a93941).

The related code is the same than in STABLE-2_1_x branch.

        /* We now check if we have segments on the ->ooseq queue that
           are now in sequence. */
        while (pcb->ooseq != NULL &&
               pcb->ooseq->tcphdr->seqno == pcb->rcv_nxt) {

          struct tcp_seg *cseg = pcb->ooseq;
          seqno = pcb->ooseq->tcphdr->seqno;

          pcb->rcv_nxt += TCP_TCPLEN(cseg);
          LWIP_ASSERT("tcp_receive: ooseq tcplen > rcv_wnd\n",
                      pcb->rcv_wnd >= TCP_TCPLEN(cseg));
          pcb->rcv_wnd -= TCP_TCPLEN(cseg);

I cannot do capture since this bug had appeared once in-field to one of our customers.

David GIRAULT <dgirault>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dgirault (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    No changes have been made to this item

    Back to the top

    Powered by Savane 3.5