buglwIP - A Lightweight TCP/IP stack - Bugs: bug #63305, pbuf memory leak occurs when tcp...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #63305: pbuf memory leak occurs when tcp packets are out of order.

Submitter:  jiangheng <jinag12345>
Submitted:  Wed 02 Nov 2022 12:21:27 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Invalid
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.1.3

Wed 11 Oct 2023 07:56:46 PM UTC, comment #2: 

I can only assume that comment #1 means this is invalid. Plus we haven't seen pbuf leaks in that area for ages...

I'm just not sure why you marked this as "crash error" when its clearly stated as "according to code review"?

Simon Goldschmidt <goldsimon>
Group administrator
Tue 15 Nov 2022 07:33:40 AM UTC, comment #1: 

In practice, the pbuf was released correctly. although I don't know how

jiangheng <jinag12345>
Wed 02 Nov 2022 12:21:27 PM UTC, original submission:  

according to code review:
1. tcp packets are out of sequence, lwip will create segment(tcp_seg_copy), pbuf->ref will add 1 (Assume that pbuf->ref sent by driver is 1),pbuf->ref now is 2.

https://git.savannah.nongnu.org/cgit/lwip.git/tree/src/core/tcp_in.c#n1656

2. then in “Received in-sequence data, adjust ooseq data” code branch:
https://git.savannah.nongnu.org/cgit/lwip.git/tree/src/core/tcp_in.c#n1524
https://git.savannah.nongnu.org/cgit/lwip.git/tree/src/core/tcp_in.c#n1506
If the new TCP data can completely overwrite the old pcb->ooseq, lwip call tcp_free_seg, pbuf->ref increase 1 and then no one increase it again. In this case, the PBUF memory leaks.

Note:
In the normal process, lwip call tcp_free_seg, pbuf->ref increase 1. then lwip translate data to the upper layer. The upper-layer app call pbuf_free to release the pbuf.





jiangheng <jinag12345>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by jinag12345 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-10-11 goldsimon StatusNone Invalid
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code