Reassembles incoming IP crash my system

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

Reassembles incoming IP crash my system

Amir Bukhari-2
I am using lwip under mpc5200 and it work fine, until a client send a big IP
packet. In this case the lwip crash on
Ip_frag.c: line 263
memcpy(q->payload, &ip_reassbuf[i],
            q->len > ip_reasslen - i ? ip_reasslen - i : q->len);

Then I disable reasemble big IP in lwipopts.h, so that such packets will be
droped.

It crash in my case by using "ping" like:

Ping host -s 1524

Is that a bug or I have may forgot something?

-Amir


_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

Re: Reassembles incoming IP crash my system

Christiaan Simons


Amir wrote:

> I am using lwip under mpc5200 and it work fine, until a client send a big
IP
> packet. In this case the lwip crash on
> Ip_frag.c: line 263
> memcpy(q->payload, &ip_reassbuf[i],
>             q->len > ip_reasslen - i ? ip_reasslen - i : q->len);
>
> Then I disable reasemble big IP in lwipopts.h, so that such packets will
be
> droped.
>
> It crash in my case by using "ping" like:
>
> Ping host -s 1524
>
> Is that a bug or I have may forgot something?



Yes, I also found this piece of code a bit suspect / not robust.

I had to fix a bug in my network driver to get this in a workable state.

Make sure your ethernet driver uses correct MTU, then it should work.



Bye,


Christiaan Simons

Hardware Designer
Axon Digital Design

http://www.axon.tv




_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

RE: Reassembles incoming IP crash my system

Amir Bukhari-2
In reply to this post by Amir Bukhari-2
It was alignment issue, I have used 4 byte alignment and thus case alignment
exception (PPC) to occure.
In one machine of two machine, which has MPC5200, an alignment exception is
occure and in the other is just crash, before the exception run, I don't
know why.
But as I used 2 byte alignment it work as expected.

-Amir

-----Original Message-----
From: Christiaan Simons [mailto:[hidden email]]
Sent: Tuesday, March 21, 2006 9:17 AM
To: [hidden email]
Subject: Re: [lwip-users] Reassembles incoming IP crash my system



Amir wrote:

> I am using lwip under mpc5200 and it work fine, until a client send a
> big
IP
> packet. In this case the lwip crash on
> Ip_frag.c: line 263
> memcpy(q->payload, &ip_reassbuf[i],
>             q->len > ip_reasslen - i ? ip_reasslen - i : q->len);
>
> Then I disable reasemble big IP in lwipopts.h, so that such packets
> will
be
> droped.
>
> It crash in my case by using "ping" like:
>
> Ping host -s 1524
>
> Is that a bug or I have may forgot something?



Yes, I also found this piece of code a bit suspect / not robust.

I had to fix a bug in my network driver to get this in a workable state.

Make sure your ethernet driver uses correct MTU, then it should work.



Bye,


Christiaan Simons

Hardware Designer
Axon Digital Design

http://www.axon.tv




_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

Re: Reassembles incoming IP crash my system

Derek Guerdon
On Tue, 21 Mar 2006 16:51:12 +0100, Amir wrote:

>It was alignment issue, I have used 4 byte alignment and thus case alignment
>exception (PPC) to occure.
>In one machine of two machine, which has MPC5200, an alignment exception is
>occure and in the other is just crash, before the exception run, I don't
>know why.
>But as I used 2 byte alignment it work as expected.
>
>-Amir
>
>> I am using lwip under mpc5200 and it work fine, until a client send a
>> big
>IP
>> packet. In this case the lwip crash on
>> Ip_frag.c: line 263
>> memcpy(q->payload, &ip_reassbuf[i],
>>             q->len > ip_reasslen - i ? ip_reasslen - i : q->len);
>>
>> Then I disable reasemble big IP in lwipopts.h, so that such packets
>> will
>be
>> droped.
>>
>> It crash in my case by using "ping" like:
>>
>> Ping host -s 1524
>>
>> Is that a bug or I have may forgot something?
>

It sounds like your problem is alignment of reassbuf. Below is a diff
that should force your compiler to align the buffer on the correct
boundary.

Please note that there are also issues of this same sort in mem.c,
memp.c, and pbuf.c.

Hope this helps:

Index: ip_frag.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv4/ip_frag.c,v
retrieving revision 1.21
diff -r1.21 ip_frag.c
80c80,87
< static u8_t ip_reassbuf[IP_HLEN + IP_REASS_BUFSIZE];
---
> static union
> {
>   struct ip_hdr hdr;
>   u8_t buf[IP_HLEN + IP_REASS_BUFSIZE];
> } reass_mem;
>
> #define ip_reassbuf reass_mem.buf
>

--
Derek Guerdon



_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users
Reply | Threaded
Open this post in threaded view
|

How to use RawAPI to send the data ?

陳 小擁
In reply to this post by Amir Bukhari-2
Hi, all :
    I am going to use RawAPI to send the data between PC to my platform based on ARM. my platform can recieved data form PC now . However , when i try to send data form my platform to PC , it dosen't work ! my code is below :
 
if(tcp_sndbuf(pcb) < hs->left) {
    len = tcp_sndbuf(pcb);
  } else {
    len = hs->left;
  }
  do {
    err = tcp_write(pcb, hs->file, len, 0);
    if(err == ERR_MEM) {
      len /= 2;
    }
  } while(err == ERR_MEM && len > 1); 
 
  if(err == ERR_OK) {
    hs->file += len;
    hs->left -= len;
  }
 
Is it somthing wrong in this code ? Can someone tell me how to send data by RawAPI . Thanks !

_______________________________________
YM - 離線訊息
就算你沒有上網,你的朋友仍可以留下訊息給你,當你上網時就能立即看到,任何說話都冇走失。
http://messenger.yahoo.com.hk
_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users

Reply | Threaded
Open this post in threaded view
|

RE: Reassembles incoming IP crash my system

Amir Bukhari-2
In reply to this post by Amir Bukhari-2
Thank you for the info.
It help a lot, as I force my compiler to not assume that alignment are
handled by CPU.
I do not wait for such exception with my software. I write a realtime OS
which do not handle this exception, because all process are running in super
user mode (like kernel module) and it is not allowed to have alignment
issues.
Therefor it is better to catch such failure during development.

-Amir

-----Original Message-----
From: lwip-users-bounces+bukhari=[hidden email]
[mailto:lwip-users-bounces+bukhari=[hidden email]] On Behalf Of Derek
Guerdon
Sent: Tuesday, March 21, 2006 8:35 PM
To: Mailing list for lwIP users
Subject: Re: [lwip-users] Reassembles incoming IP crash my system

On Tue, 21 Mar 2006 16:51:12 +0100, Amir wrote:

>It was alignment issue, I have used 4 byte alignment and thus case
>alignment exception (PPC) to occure.
>In one machine of two machine, which has MPC5200, an alignment
>exception is occure and in the other is just crash, before the
>exception run, I don't know why.
>But as I used 2 byte alignment it work as expected.
>
>-Amir
>
>> I am using lwip under mpc5200 and it work fine, until a client send a
>> big
>IP
>> packet. In this case the lwip crash on
>> Ip_frag.c: line 263
>> memcpy(q->payload, &ip_reassbuf[i],
>>             q->len > ip_reasslen - i ? ip_reasslen - i : q->len);
>>
>> Then I disable reasemble big IP in lwipopts.h, so that such packets
>> will
>be
>> droped.
>>
>> It crash in my case by using "ping" like:
>>
>> Ping host -s 1524
>>
>> Is that a bug or I have may forgot something?
>

It sounds like your problem is alignment of reassbuf. Below is a diff that
should force your compiler to align the buffer on the correct boundary.

Please note that there are also issues of this same sort in mem.c, memp.c,
and pbuf.c.

Hope this helps:

Index: ip_frag.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv4/ip_frag.c,v
retrieving revision 1.21
diff -r1.21 ip_frag.c
80c80,87
< static u8_t ip_reassbuf[IP_HLEN + IP_REASS_BUFSIZE];
---
> static union
> {
>   struct ip_hdr hdr;
>   u8_t buf[IP_HLEN + IP_REASS_BUFSIZE]; } reass_mem;
>
> #define ip_reassbuf reass_mem.buf
>

--
Derek Guerdon



_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users


_______________________________________________
lwip-users mailing list
[hidden email]
http://lists.nongnu.org/mailman/listinfo/lwip-users