[lwip-devel] [bug #28562] Segfault @ err_tcp

[Homyak]

URL:
  <http://savannah.nongnu.org/bugs/?28562>

                 Summary: Segfault  @ err_tcp
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: onlyslon
            Submitted on: Tue 12 Jan 2010 11:47:47 AM GMT
                Category: TCP
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: CVS Head

    _______________________________________________________

Details:

Have 2 threads. - tcp/ip thread & tcp read thread.



it look like lwip bug, but Im not sure. Please fix me if I mistaken

Thanks.


Ok.  I just have segfault sometimes

TCP thread  backtrace - 
------------------------------------
#0  0x08063b10 in sys_mbox_post (mbox=0x0, msg=0x0) at
lwip/cvs/contrib/ports/unix/sys_arch.c:372
#1  0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at
lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
#2  0x0808a7d1 in tcp_input (p=0x85f1c60, inp=0x88363f4) at
lwip/cvs/contrib/../lwip/src/core/tcp_in.c:313
#3  0x08060db7 in ip_input (p=0x85f1c60, inp=0x88363f4) at
lwip/cvs/contrib/../lwip/src/core/ipv4/ip.c:417
#4  0x08061e3c in tcpip_thread (arg=0x0) at
lwip/cvs/contrib/../lwip/src/api/tcpip.c:111
#5  0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#6  0xb7e523ae in clone () from /lib/libc.so.6
(gdb) up
#1  0x0808ea58 in err_tcp (arg=0x826216c, err=-6 '�') at
lwip/cvs/contrib/../lwip/src/api/api_msg.c:322
322         sys_mbox_post(conn->recvmbox, NULL);
(gdb) p *conn
$4 = {type = NETCONN_TCP, state = NETCONN_NONE, pcb = {ip = 0x0, tcp = 0x0,
udp = 0x0, raw = 0x0}, err = -6 '�', op_completed = 0x899e998, recvmbox =
0x0,
  acceptmbox = 0x0, socket = 2, recv_timeout = 1000, recv_bufsize =
2147483647, recv_avail = 0, write_msg = 0x0, write_offset = 0,
  callback = 0x806e77d <sx3g_event_callback>}

 

READER thread backtrace 
(gdb) bt
#2  0xb7e5eb84 in pthread_cond_timedwait () from /lib/libc.so.6
#3  0x08064138 in cond_wait (cond=0x89db07c, mutex=0x89db0ac, timeout=1) at
lwip/cvs/contrib/ports/unix/sys_arch.c:617
#4  0x08064223 in sys_arch_sem_wait (sem=0x89db078, timeout=1) at
lwip/cvs/contrib/ports/unix/sys_arch.c:650
#5  0x08063d58 in sys_arch_mbox_fetch (mbox=0x8abb148, msg=0xb4f04298,
timeout=1) at lwip/cvs/contrib/ports/unix/sys_arch.c:476
#6  0x0808efe3 in netconn_drain (conn=0x826216c, bytes_drained=0xb4f042d0,
accepts_drained=0xb4f042ce) at lwip/cvs/contrib/../lwip/src/api/api_msg.c:624
#7  0x0808dec7 in netconn_delete (conn=0x826216c) at
lwip/cvs/contrib/../lwip/src/api/api_lib.c:114
#8  0x0806bcb0 in lwip_close (s=2) at  sockets.c:421
#9  0x0806a14f in tcp_read_thread (arg=0x8836328) at tcp_handlers.c:408
#10 0xb7ac81b5 in start_thread () from /lib/libpthread.so.0
#11 0xb7e523ae in clone () from /lib/libc.so.6


Situation -  
- we got RST from remote side
- tcp/ip thread call err_tcp 
@api_msg.c line 319

  if (conn->recvmbox != SYS_MBOX_NULL) {
    /* Register event with callback */
    API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0);
    sys_mbox_post(conn->recvmbox, NULL);
  }


-  After   API_EVENT(conn, NETCONN_EVT_RCVPLUS, 0); TCP read thread got 
waked  and start trying read from socket and cause lwip_read returned - 0
bytes - trying to close socket

- First all lwip_close call netconn_delete -> netconn_drain 
netconn_drain set recvmbox to SYS_MBOX_NULL and after switch context to
tcp/ip thread we got segfault at sys_mbox_post(conn->recvmbox, NULL);  cause
recvmbox = NULL

  Plsease fix me if I wrong.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?28562>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/