[lwip-devel] [bug #63305] pbuf memory leak occurs when tcp packets are out of order.

[jiangheng]

URL:
  <https://savannah.nongnu.org/bugs/?63305>

                 Summary: pbuf memory leak occurs when tcp packets are out of
order.
                 Project: lwIP - A Lightweight TCP/IP stack
               Submitter: jinag12345
               Submitted: Wed 02 Nov 2022 12:21:27 PM UTC
                Category: TCP
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: 2.1.3


    _______________________________________________________

Follow-up Comments:


-------------------------------------------------------
Date: Wed 02 Nov 2022 12:21:27 PM UTC By: jiangheng <jinag12345>
according to code review:
1. tcp packets are out of sequence, lwip will create segment(tcp_seg_copy),
pbuf->ref will add 1 (Assume that pbuf->ref sent by driver is 1),pbuf->ref now
is 2.

https://git.savannah.nongnu.org/cgit/lwip.git/tree/src/core/tcp_in.c#n1656

2. then in “Received in-sequence data, adjust ooseq data” code branch:
https://git.savannah.nongnu.org/cgit/lwip.git/tree/src/core/tcp_in.c#n1524
https://git.savannah.nongnu.org/cgit/lwip.git/tree/src/core/tcp_in.c#n1506
If the new TCP data can completely overwrite the old pcb->ooseq, lwip call
tcp_free_seg, pbuf->ref increase 1 and then no one increase it again. In this
case, the PBUF memory leaks.

Note:
In the normal process, lwip call tcp_free_seg, pbuf->ref increase 1. then lwip
translate data to the upper layer. The upper-layer app call pbuf_free to
release the pbuf.












    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?63305>

_______________________________________________
Message sent via Savannah
https://savannah.nongnu.org/