lwIP - A Lightweight TCP/IP stack - Bugs: bug #57378, Assertion "tcp_slowtimr:...
You are not allowed to post comments on this tracker with your current authentication level.
bug #57378: Assertion "tcp_slowtimr: persist ticking with empty send buffer" failed
Submitter: | Hiromasa Ito <vhertz> | ||
Submitted: | Sat 07 Dec 2019 01:19:05 PM UTC | ||
Category: | TCP | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | None |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open | Planned Release: | None |
lwIP version: | Other |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
No changes have been made to this item
Powered by Savane 3.13-3e34.
Corresponding source code
Hi, all.
This is one of the assertion failures I found by fuzzing (to lwIP ver2.1.0.RC1).
The following LWIP_ASSERT() at lwip/src/core/tcp.c:1235 fails.
From my point of view, incoherent pcb->unsent freeing causes this failure.
As far as I know, pcb->unsent is freed at:
- tcp_abansdon()
- tcp_pcb_purge()
- tcp_receive()
In tcp_receive(), pcb->persist_backoff is not cleared after freeing pcb->unsent.
As a result, pcb->persist_backoff > 0 in spite of pcb->unsent is empty.
You can reproduce this failure with 'crashed_inputs/007' attached to the following message of lwip-devel:
https://lists.nongnu.org/archive/html/lwip-devel/2019-12/msg00013.html