Re: AW: [lwip-users] pbufs get lost

[Leon Woestenberg]

Hello Dennis,

address@hidden wrote:
> Hello Pasi,
>  
> It seems to me that this error is only present in lwip 1.1.0. I am using 
> lwip 1.1.0 with my own proprietary RTOS running on top of MS Windows, 
> and lwip crashes sometimes with a protection fault, always in the tcp 
> queueing code.
> I have looked to the lwip 1.0.0 sources and found that there is a "queue 
> = NULL;" statement in line 122 of tcp_out.c. This initialization of 
> the queue pointer seems to got lost in lwip 1.1.0. The old code looks 
> like that:
>  
No, the initialization of queue = NULL is not lost. See line 161:

  /* First, break up the data into segments and tuck them together in
   * the local "queue" variable. */
  useg = queue = seg = NULL;
  seglen = 0;
  while (queue == NULL || left > 0) {


However, queue was referenced if the first "goto memerr" was executed,
in the memerr: label code.

I have committed the fix given by Pasi Kukkonen (see below).

Regards,

Leon.


> [....]
>
> queue *=* NULL;
> LWIP_DEBUGF(TCP_QLEN_DEBUG, ("tcp_enqueue: queuelen: %u\n", (unsigned 
> int)pcb*->*snd_queuelen));
>
> /* Check if the queue length exceeds the configured maximum queue
>  * length. If so, we return an error. */
> queuelen *=* pcb*->*snd_queuelen;
> if (queuelen *>=* TCP_SND_QUEUELEN) {
>  LWIP_DEBUGF(TCP_OUTPUT_DEBUG *|* 3, ("tcp_enqueue: too long queue %u 
> (max %u)\n", queuelen, TCP_SND_QUEUELEN));
>  goto memerr;
> }
>
> [...]
>
>  
> Leon, can you please fix this in CVS ?
>  
> Dennis
>  
>
>     -----Ursprüngliche Nachricht-----
>     *Von:* address@hidden
>     [mailto:address@hidden Auftrag
>     von* address@hidden
>     *Gesendet am:* Donnerstag, 3. Februar 2005 09:35
>     *An:* address@hidden
>     *Betreff:* [lwip-users] pbufs get lost
>
>     I have used  tcpecho in card and PC program to generate different
>     size of messages to be sent to card to test tcp connection.
>     Everyting is working when I send more than ~200 bytes in message,
>     but when size is decreased pbufs get lost. This happends because
>     sys_mbox_post can't put message into queue, it's full and it just
>     discards whole packet, -> memory not freed!
>
>     sys_mbox_post should return with error if message is not handled and
>     upper layer should do cleanup!
>
>     I used API (not raw Api) ported to uC/OS.  
>
>     While doing  testing I found bug in tcp_out.c.
>
>       /* If total number of pbufs on the unsent/unacked queues exceeds the
>        * configured maximum, return an error */
>       queuelen = pcb->snd_queuelen;
>       if (queuelen >= TCP_SND_QUEUELEN) {
>         LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 3, ("tcp_enqueue: too long queue
>     %u (max %u)\n", queuelen, TCP_SND_QUEUELEN));
>         goto memerr;
>       }
>
>     should be (because queue is not initialized and used in memerr):
>
>       /* If total number of pbufs on the unsent/unacked queues exceeds the
>        * configured maximum, return an error */
>       queuelen = pcb->snd_queuelen;
>       if (queuelen >= TCP_SND_QUEUELEN) {
>         LWIP_DEBUGF(TCP_OUTPUT_DEBUG | 3, ("tcp_enqueue: too long queue
>     %u (max %u)\n", queuelen, TCP_SND_QUEUELEN));
>         return ERR_MEM;
>       }
>
>     --
>     Pasi 
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> lwip-users mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/lwip-users