[lwip-devel] [bug #48543] TCP sent callback may prematurely report sent data when only part of a segment is acked

[Ambroz Bizjak]

URL:
  <http://savannah.nongnu.org/bugs/?48543>

                 Summary: TCP sent callback may prematurely report sent data
when only part of a segment is acked
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: abizjak
            Submitted on: Sun 17 Jul 2016 02:20:30 PM GMT
                Category: TCP
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

Suppose the application is using tcp_write() without TCP_WRITE_FLAG_COPY to
send data directly from a buffer. In this case it needs to carefully monitor
the tcp_sndbuf and/or rely on the sent callback to see when it may reuse old
buffers.

A problem is that if the remote acks only part of a segment (which I suppose
is rare but valid), the sent callback will report some data as sent, but the
TCP segment for that data has not yet been freed, since it contains unacked
data. Since the application has no idea how the data was segmented, it may go
on reusing the acked part of its buffers, which is still referenced by lwIP.




    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?48543>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/