[lwip-devel] [bug #46471] lwip_accept() leaks socket descriptors if new netconn was already closed because of peer behavior

[Kerem Hadimli]

URL:
  <http://savannah.nongnu.org/bugs/?46471>

                 Summary: lwip_accept() leaks socket descriptors if new
netconn was already closed because of peer behavior
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: keremhadimli
            Submitted on: Wed 18 Nov 2015 10:49:23 AM GMT
                Category: sockets/netconn
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: git head

    _______________________________________________________

Details:

A few commits behind LwIP master, we see this with a sequence like:

- A host sends a SYN to LwIP device
- LwIP device SYN-ACKs the host, creates the netconn in
established/establishing state, posts it to accept mbox
- Host responds with RST (the whole sequence takes over 10 seconds while our
device was watchdog-rebooting)
- LwIP marks the netconn as closed
- lwip_accept() is called on socket layer, it fetches the netconn object from
accept mbox
- lwip_accept() allocates a socket number to it. sockets[newsock]->conn ==
new_netconn
- lwip_accept() tries to get the address of the peer. netconn_peer() returns
error -11 (ERR_CONN not connected)
- lwip_accept() calls "netconn_delete(newconn);", and returns -1.  Socket is
still pointing to that pointer.
- Next connection attempts re-use the pointer because of memory pooling, then
multiple socket descriptors point to the same netconn pointer
- eventually socket descriptors run out, and no more TCP connections can be
accepted

A patch is attached.



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Wed 18 Nov 2015 10:49:23 AM GMT  Name:
lwip_socket_accept_descriptor_leak.diff  Size: 957B   By: keremhadimli

<http://savannah.nongnu.org/bugs/download.php?file_id=35493>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?46471>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/