This is an automated email from the ASF dual-hosted git repository.
kasjer pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
The following commit(s) were added to refs/heads/master by this push:
new 309fa118a net/ip/lwip_mn: Do not assert on mbuf shortage in TCP receive
309fa118a is described below
commit 309fa118a2c7e09b1dd3d27ca19f565980e51a7d
Author: Jerzy Kasenberg <[email protected]>
AuthorDate: Wed Oct 14 11:38:51 2026 +0200
net/ip/lwip_mn: Do not assert on mbuf shortage in TCP receive
lwip_sock_tcp_rx() asserted when msys mbuf could not be allocated
for received data. Burst of few kilobytes of TCP data sent by remote
peer was enough to exhaust default msys pool and crash the device.
Return ERR_MEM instead so lwIP keeps the data and delivers it again
when application frees buffers.
Copy loops in TCP and UDP receive callbacks used length of the first
pbuf for every element of the chain and did not advance offset, so
chained pbufs were copied incorrectly. Use length of each pbuf,
advance offset and handle copy failure.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jerzy Kasenberg <[email protected]>
---
net/ip/lwip_mn/src/lwip_socket.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
diff --git a/net/ip/lwip_mn/src/lwip_socket.c b/net/ip/lwip_mn/src/lwip_socket.c
index a8417c185..9a08bdb71 100644
--- a/net/ip/lwip_mn/src/lwip_socket.c
+++ b/net/ip/lwip_mn/src/lwip_socket.c
@@ -200,7 +200,12 @@ lwip_sock_udp_rx(void *arg, struct udp_pcb *pcb, struct
pbuf *p,
addr, port);
off = 0;
for (q = p; q; q = q->next) {
- os_mbuf_copyinto(m, off, q->payload, p->len);
+ if (os_mbuf_copyinto(m, off, q->payload, q->len)) {
+ os_mbuf_free_chain(m);
+ pbuf_free(p);
+ return;
+ }
+ off += q->len;
}
pbuf_free(p);
STAILQ_INSERT_TAIL(&s->ls_rx, OS_MBUF_PKTHDR(m), omp_next);
@@ -224,12 +229,22 @@ lwip_sock_tcp_rx(void *arg, struct tcp_pcb *pcb, struct
pbuf *p, err_t err)
mn_socket_readable(&s->ls_sock, MN_ECONNABORTED);
return ERR_OK;
}
+ /*
+ * When there is no memory for data, ERR_MEM tells lwIP to keep the pbuf
+ * and deliver it again later. Receive window is not opened until
+ * application reads data, so sender can't overrun this.
+ */
m = os_msys_get_pkthdr(p->tot_len, 0);
- assert(m);
- /* XXX fix this */
+ if (!m) {
+ return ERR_MEM;
+ }
off = 0;
for (q = p; q; q = q->next) {
- os_mbuf_copyinto(m, off, q->payload, p->len);
+ if (os_mbuf_copyinto(m, off, q->payload, q->len)) {
+ os_mbuf_free_chain(m);
+ return ERR_MEM;
+ }
+ off += q->len;
}
pbuf_free(p);
STAILQ_INSERT_TAIL(&s->ls_rx, OS_MBUF_PKTHDR(m), omp_next);
