ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2025-05-29 13:44:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

VFS LwIP: do not free TCP PCBs on error

Browse Source 
The VFS LwIP plugin is page-faulting on connect error because the LwIP
library frees a failed TCP protocol control block before calling the
error callback, and then the VFS plugin dereferences the PCB to free it
a second time. This problem was caused by a failure to follow
documentation during a transition from a C callback to a C++ method.

Fix #2972
This commit is contained in:
Emery Hemingway 2018-09-10 13:57:52 +02:00 committed by Christian Helmuth
parent 770fc77584
commit 98380cebda
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
repos/libports/include/lwip/arch/cc.h
View File

@ -61,6 +61,7 @@ typedef uintptr_t mem_ptr_t;
#ifndef LWIP_NO_INTTYPES_H #ifndef LWIP_NO_INTTYPES_H
#define LWIP_NO_INTTYPES_H 1 #define LWIP_NO_INTTYPES_H 1
/* Define (sn)printf formatters */ /* Define (sn)printf formatters */
#define X8_F "02x"
#define U16_F "u" // we don't have hu #define U16_F "u" // we don't have hu
#define S16_F "d" // we don't have hd #define S16_F "d" // we don't have hd
#define X16_F "x" // we don't have hx #define X16_F "x" // we don't have hx

10
repos/libports/src/lib/vfs/lwip/vfs.cc
View File

@ -1092,17 +1092,13 @@ class Lwip::Tcp_socket_dir final :
* *
* Triggered by error callback, usually * Triggered by error callback, usually
* just by an aborted connection. * just by an aborted connection.
* The corresponding pcb is already freed
* when this callback is called!
*/ */
void error() void error()
{ {
state = CLOSED; state = CLOSED;
_pcb = NULL;
/* the PCB is expired now */
if (_pcb) {
tcp_arg(_pcb, NULL);
tcp_close(_pcb);
_pcb = NULL;
}
/* churn the application */ /* churn the application */
handle_io(~0U); handle_io(~0U);