[lwip-users] lwip 2.0.3 "p->ref > 0" assert

[Markus Pischinger]

Hello,

i'm using lwip 2.0.3 on a cortex m4 board (atmel sam4e).
On high traffic (like zenmap "intense scan, all ports") i always get the p->ref > 0 assert in pbuf.c line 747.
If i look at the call stack it always seems to happen during pbuf_realloc called from ip4_input.
Going one step back to the pbuf_realloc where pbuf_free(q->next); is called

  /* any remaining pbufs in chain? */
  if (q->next != NULL) {
    /* free remaining pbufs in chain */
    pbuf_free(q->next);
  }

There I see that q->next is indeed not NULL but all the data inside is 0, including the ref.
Does anyone know how that can happen?

Below you'll find a screenshot from Atmel Studio taken before the pbuf_free(q->next); call.


Thanks in advance,
Markus