buglwIP - A Lightweight TCP/IP stack - Bugs: bug #24440, TCP connection close problem on...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #24440: TCP connection close problem on 64-bit host

Submitter:  David Woodhouse <dwmw2>
Submitted:  Fri 03 Oct 2008 01:19:22 PM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Crash Error Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  CVS Head

Mon 16 Feb 2009 04:51:42 PM UTC, comment #3: 

Fixed.

Simon Goldschmidt <goldsimon>
Group administrator
Wed 11 Feb 2009 06:55:34 PM UTC, comment #2: 


> there's no need for an accept callback entry on a struct tcp_pcb


I'm afraid there is: when a new connection is opened by a listening pcb, the accept pointer is copied to the new tcp_pcb. The reason is the callback is only called after the ACK for the SYN is received from the remote host.

> tcp_accept() should take a struct tcp_pcb_listen type


But we need to reset the accept pointer for a normal pcb, too. I guess a better fix would be to move accept into TCP_PCB_COMMON so that it is the same for both tcp pcb types.

An even better fix would be to change the *_PCB_COMMON/IP_PCB defines to aggregating other structs so that we are safe from compilers that change the layout of structs, but that could well be another discussion...

Simon Goldschmidt <goldsimon>
Group administrator
Fri 03 Oct 2008 01:25:00 PM UTC, comment #1: 

A safe work-around would be to prefix the call to tcp_accept in do_listen_internal() with:

 if (pcb->state == LISTEN)

I think.  I've not tried this though.

To fix properly needs a little bit of work though - there's some cleaning up that can be done (there's no need for an accept callback entry on a struct tcp_pcb) and tcp_accept() should take a struct tcp_pcb_listen type.

Kieran Mansley <kieranm>
Group Member
Fri 03 Oct 2008 01:19:22 PM UTC, original submission:  

When I build the simhost project for x86_64 Linux, telnet into it and type 'quit', I see bogus ACK numbers in the resulting fin packets.

It looks like pcb->rcv_nxt is being scribbled on by tcp_accept(), which is called from do_close_internal() and casts its argument to some other kind of structure.


tcp_output_segment, pcb 0x629730, pcb->rcv_nxt (at 0x629760) is 6566caf6
quit
Closed
tcp_accept: tcp_pcb 0x629730, accept (nil). Set pcb->accept at 0x629760
tcp_output_segment, pcb 0x629730, pcb->rcv_nxt (at 0x629760) is 0



Catching it in the act in gdb...

Hardware watchpoint 2: (int ) 6461504

Old value = -2094160047
New value = 0
tcp_accept (pcb=0x629810, accept=0)
at ../../../../../lwip/src/core/tcp.c:1118
1118    }
(gdb) bt
#0  tcp_accept (pcb=0x629810, accept=0)
    at ../../../../../lwip/src/core/tcp.c:1118
#1  0x000000000040f1a0 in do_close_internal (conn=0x62a1c0)
    at ../../../../../lwip/src/api/api_msg.c:606
#2  0x000000000040ff1c in do_close (msg=0x445d4018)
    at ../../../../../lwip/src/api/api_msg.c:1124
#3  0x0000000000410107 in tcpip_thread (arg=0x0)
    at ../../../../../lwip/src/api/tcpip.c:269
#4  0x000000372940729a in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
#5  0x00000037288e439d in clone () from /lib64/libc.so.6

David Woodhouse <dwmw2>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by kieranm (Posted a comment)
  • -email is unavailable- added by dwmw2 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-02-16 goldsimon CategoryNone TCP
        Item GroupNone Crash Error
        StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code