[lwip-users] Lock in tcp_in

[Lou Cypher]

I'm using lwIP 1.3.1 and I had a couple of very infrequent locks happening.
The problem (from what I know) arose only two times, over many packets and
switch on/off of my embedded device, in a few months.
Last time it happened I had the debugger active, so I could find where it
happened, but since I was short in time for many reasons, I just take notes
about it.

The system is running some services through TCP/IP, client and server, one of
them is an HTTP server, and the flaw happened on local port 80.
I had the code stuck in the for() loop starting on line 207 of tcp_in.c,
----------------------------------------------------------------------------
    for(pcb = tcp_tw_pcbs; pcb != NULL; pcb = pcb->next) {
----------------------------------------------------------------------------
and it couldn't exit from there, since I had pcb->next == pcb, so there was no
NULL pointer to stop it, but a rewind to itself.
The if() test inside the loop was failing too,
----------------------------------------------------------------------------
      if (pcb->remote_port == tcphdr->src &&
         pcb->local_port == tcphdr->dest &&
         ip_addr_cmp(&(pcb->remote_ip), &(iphdr->src)) &&
         ip_addr_cmp(&(pcb->local_ip), &(iphdr->dest))) {
----------------------------------------------------------------------------
having
  pcb->remote_port = 3545
  tcphdr->src      = 3549
  pcb->local_port  = 80
  tcphdr->dst      = 80
  pcb->remote_ip   = C0A80082
  iphdr->src       = C0A80082
  pcb->local_ip    = C0A80083
  iphdr->dest      = C0A80083
the failing test is that one against pcb->remote_port == tcphdr->src; it looks
like a test on two different sequence packets.

I'm using cooperative multithreading (say "fibers"), so there's no chance for a
task to interrupt lwIP processing; beside interrupts, of course, but they don't
invoke anything of lwIP.

Unfortunately I had no packet sniffer connected, and it seems to be very hard to
reproduce. I just hope the NULL pointer missing and the pointer wrapping can
give an hint (...)

~ Lou