Commit Graph

2453 Commits

Author SHA1 Message Date
chao.an
bf6cbbca5d net/tcp: fix devif callback list corruption on tcp_close()
devif_conn_event() will be called recursively in the psock_send_eventhandler(),
if the tcp event tcp_close_eventhandler() is marked as "next" in first devif_conn_event()
and released from sencond recursive call, the "next" event in the first devif_conn_event()
will become a wild pointer.

479 uint16_t devif_conn_event(FAR struct net_driver_s *dev, uint16_t flags,
480                           FAR struct devif_callback_s *list)
481 {
482   FAR struct devif_callback_s *next;
...
488   net_lock();
489   while (list && flags)
490     {
...
496       next = list->nxtconn;  <------------------  event tcp_close_eventhandler() on next
...
500       if (list->event != NULL && devif_event_trigger(flags, list->flags))
501         {
...
507           flags = list->event(dev, list->priv, flags);  <---------------- perform  psock_send_eventhandler(), event tcp_close_eventhandler() will be remove from tcp_lost_connection()
508         }
...
512       list = next;  <---------------- event tcp_close_eventhandler() has been released, wild pointer
513     }
514
515   net_unlock();
516   return flags;
517 }

The callstack as below:

Breakpoint 1, tcp_close_eventhandler (dev=0x56607d80 <g_sim_dev>, pvpriv=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_close.c:83
(gdb) bt
| #0  tcp_close_eventhandler (dev=0x56607d80 <g_sim_dev>, pvpriv=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_close.c:83
| #1  0x5658bb57 in devif_conn_event (dev=0x56607d80 <g_sim_dev>, flags=65, list=0x56609498 <g_cbprealloc+312>) at devif/devif_callback.c:507
                    ----------------> devif_conn_event() recursively
| #2  0x56589f8c in tcp_callback (dev=0x56607d80 <g_sim_dev>, conn=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_callback.c:169
| #3  0x565c55e4 in tcp_shutdown_monitor (conn=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_monitor.c:211
| #4  0x565c584b in tcp_lost_connection (conn=0x566084a0 <g_tcp_connections>, cb=0x566094b0 <g_cbprealloc+336>, flags=65) at tcp/tcp_monitor.c:391
| #5  0x565c028a in psock_send_eventhandler (dev=0x56607d80 <g_sim_dev>, pvpriv=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_send_buffered.c:544
                    ----------------> call psock_send_eventhandler() before tcp_close_eventhandler()
| #6  0x5658bb57 in devif_conn_event (dev=0x56607d80 <g_sim_dev>, flags=65, list=0x566094b0 <g_cbprealloc+336>) at devif/devif_callback.c:507
| #7  0x56589f8c in tcp_callback (dev=0x56607d80 <g_sim_dev>, conn=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_callback.c:169
| #8  0x5658e8cc in tcp_input (dev=0x56607d80 <g_sim_dev>, domain=2 '\002', iplen=20) at tcp/tcp_input.c:1059
| #9  0x5658ed77 in tcp_ipv4_input (dev=0x56607d80 <g_sim_dev>) at tcp/tcp_input.c:1355
| #10 0x5658c0a2 in ipv4_input (dev=0x56607d80 <g_sim_dev>) at devif/ipv4_input.c:358
| #11 0x56577017 in netdriver_recv_work (arg=0x56607d80 <g_sim_dev>) at sim/up_netdriver.c:182
| #12 0x5655999e in work_thread (argc=2, argv=0xf3db5dd0) at wqueue/kwork_thread.c:178
| #13 0x5655983f in nxtask_start () at task/task_start.c:129
(gdb) c
Continuing.
Breakpoint 1, tcp_close_eventhandler (dev=0x56607d80 <g_sim_dev>, pvpriv=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_close.c:83
(gdb) bt
| #0  tcp_close_eventhandler (dev=0x56607d80 <g_sim_dev>, pvpriv=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_close.c:83
      ----------------------> "next" corrupted, invaild call tcp_close_eventhandler()
| #1  0x5658bb57 in devif_conn_event (dev=0x56607d80 <g_sim_dev>, flags=65, list=0x56609498 <g_cbprealloc+312>) at devif/devif_callback.c:507
| #2  0x56589f8c in tcp_callback (dev=0x56607d80 <g_sim_dev>, conn=0x566084a0 <g_tcp_connections>, flags=65) at tcp/tcp_callback.c:169
| #3  0x5658e8cc in tcp_input (dev=0x56607d80 <g_sim_dev>, domain=2 '\002', iplen=20) at tcp/tcp_input.c:1059
| #4  0x5658ed77 in tcp_ipv4_input (dev=0x56607d80 <g_sim_dev>) at tcp/tcp_input.c:1355
| #5  0x5658c0a2 in ipv4_input (dev=0x56607d80 <g_sim_dev>) at devif/ipv4_input.c:358
| #6  0x56577017 in netdriver_recv_work (arg=0x56607d80 <g_sim_dev>) at sim/up_netdriver.c:182
| #7  0x5655999e in work_thread (argc=2, argv=0xf3db5dd0) at wqueue/kwork_thread.c:178
| #8  0x5655983f in nxtask_start () at task/task_start.c:129
(gdb) c
Continuing.
[    2.680000] up_assert: Assertion failed at file:devif/devif_callback.c line: 85 task: lpwork

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-30 19:41:18 +08:00
chao.an
162fcd10ca net: cleanup pvconn reference to avoid confuse
More reference:
https://github.com/apache/incubator-nuttx/pull/5252
https://github.com/apache/incubator-nuttx/pull/5434

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-26 20:58:11 +08:00
chao.an
ea621599fd net: remove pvconn reference from all devif callback
Do not use 'pvconn' argument to get the connection pointer since
pvconn is normally NULL for some events like NETDEV_DOWN.
Instead, the connection pointer can be reliably obtained from the
corresponding private pointer.

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-26 20:58:11 +08:00
chao.an
77a99acc98 net/icmpv6: fix build break "duplicate macro parameter"
Error: net/icmpv6/icmpv6.h:442:33: error: duplicate macro parameter "d"
 #  define icmpv6_setaddresses(d,d,p,p) (0)

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-26 10:00:22 +02:00
zhanghongyu
cc421e43e4 icmpv6: add NTOHL when parse ICMPV6 option MTU
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-26 10:00:22 +02:00
luojun1
00cf3e559d update IPv6 NIC parameters unconditionally when ICMPv6 RA is received
Signed-off-by: luojun1 <luojun1@xiaomi.com>
Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-26 10:00:22 +02:00
luojun1
7c2986bb34 finetune the RA parsing procedure
Signed-off-by: luojun1 <luojun1@xiaomi.com>
Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-26 10:00:22 +02:00
Fotis Panagiotopoulos
9bc47ecdce Added lock in ifr ioctl calls. 2022-08-25 14:02:20 +02:00
chao.an
9cb17841d8 net/sockopt: move BINDTODEVICE to socket level
rename the UDP_BINDTODEVICE to SO_BINDTODEVICE to follow the linux
style to be compatible with non-UDP protocol binding requirements

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-08-25 17:56:52 +08:00
Huang Qi
e4e3208180 Replace all strncpy with strlcpy for safety
Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
2022-08-25 13:38:36 +08:00
chengkai
841d8f5b37 net:add btsnoop and snoop
Signed-off-by: chengkai <chengkai@xiaomi.com>
2022-08-24 21:42:30 +08:00
Xiang Xiao
0334819742 net/usrsock: Change xid from uint64_t to uint32_t
by generating the new xid for each transaction

Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2022-08-23 12:16:33 -03:00
Xiang Xiao
697e2a333b net/usrsock: Remove dev field from usrsockdev_s
since this field isn't really used at all

Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2022-08-22 17:49:51 +03:00
zhanghongyu
e03c2c321a tcp: reset conn->nrtx when ack received
Otherwise, when a long test triggers multiple timeout retransmissions,
the late timeout retransmissions are always delayed between 24 and 48 seconds

Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
2022-08-17 21:35:09 +03:00
Xiang Xiao
ba9486de4a iob: Remove iob_user_e enum and related code
since it is impossible to track producer and consumer
correctly if TCP/IP stack pass IOB directly to netdev

Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2022-08-15 08:41:20 +03:00
Xiang Xiao
838690fc9f net/local: Remove the sync preamble from datagram
since pipe is a reliable transport, the sync just waste the space and time

Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2022-08-10 09:50:25 +03:00
Jiuzhu Dong
fe17f747a7 fs/directory: move private directory information to filesystem
Signed-off-by: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
2022-08-09 23:30:01 +08:00
Jiuzhu Dong
90db4daca9 fs/directory: update readdir interface for all filesystem
Signed-off-by: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
2022-08-09 23:30:01 +08:00
田昕
20b9cc37d5 net/local:Make local send multi-thread safe
Signed-off-by: 田昕 <tianxin7@xiaomi.com>
2022-08-08 22:45:44 +08:00
Petro Karashchenko
b3cd9090d1 drivers/net: make sure that net driver d_buf is 16-bit aligned
Signed-off-by: Petro Karashchenko <petro.karashchenko@gmail.com>
2022-08-05 22:21:37 +08:00
Peter van der Perk
013a562478 Net thread-safe ntoa functions
Apply suggestions from code review

Co-authored-by: Petro Karashchenko <petro.karashchenko@gmail.com>
2022-08-02 21:04:19 +08:00
Peter van der Perk
26dbdba5d8 [TCP] Close RAM usage optimization 2022-07-29 23:51:06 +08:00
liyi
b232508bd9 make sure conn's domain is match with addr's family 2022-07-29 13:53:19 +08:00
ligd
8a3683fb9f rptun: add ns_match callback to resolve rptun deadlock
thread A: accept -> net_lock -> socket_rpmsg_accept
          -> rpmsg_register_callabck -> rptun_lock
thread B: ns_bind -> rpmsg_socket_ns_bind -> get_tx_payload_buffer
          -> rptun_wait_tx -> usrsock_rpmsg_ept_cb -> usrsockdev_write
          -> net_lock -> deadlock

fix:
add ns_match callback

Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-27 20:36:51 +08:00
zhanghongyu
fc35cf4737 udp: Use s_sndtimeo as the actual timeout time
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
2022-07-26 12:06:14 +03:00
zhanghongyu
ef660083c8 tcp: check option length before d_len update
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
2022-07-26 12:05:06 +03:00
Peter van der Perk
b3590f00b3 NXStyle and preprocessor fixes
Co-authored-by: Jari van Ewijk <jari.vanewijk@nxp.com>
2022-07-25 23:47:05 +08:00
Jari van Ewijk
51a845ce54 SocketCAN: add non-blocking write
Co-authored-by: Peter van der Perk <peter.vanderperk@nxp.com>
2022-07-25 23:47:05 +08:00
zhanghongyu
51a262150d wifi: clear IFF_RUNNING flag when ifdown
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
2022-07-25 15:29:24 +08:00
zhanghongyu
7467586d55 netdev: add return value for ifup / ifdown
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
2022-07-25 15:29:24 +08:00
ligd
79952163c1 rpmsg_socket: use sendto_nocopy() instead of send_nocopy().
only wait ept ready after ept_create, not after ept_destroy

Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-23 08:16:48 +03:00
ligd
9c106c1bdc rpmsg_socket: defalut set POLLERR POLLHUP to events
Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-23 08:16:48 +03:00
ligd
ba990619ed socket_rpmsg: set poll err instead return err
Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-23 08:16:48 +03:00
ligd
630ca45a50 rpmsg_socket: connect addrlen can bigger then expect
Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-23 08:16:48 +03:00
Jiuzhu Dong
fab2f6d3d8 net/rpmsg: fix minor issue on strncpy
Signed-off-by: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
2022-07-23 08:16:48 +03:00
ligd
5b9a953381 local: fix nx_style
Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-22 14:07:12 +03:00
ligd
390de249a0 local: connect operation should jump self's connection
Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-22 14:07:12 +03:00
ligd
cd5ab80f2f local: server accept should wait client connect done
server:
at accept last nxsem_post(&client->lc_waitsem);

client:
connect wait(&client->lc_waitsem) then local_open_client_rx();

But if the server priority is higher then client,
and after server accept return, immediately call send().
At this time the client has no way do local_open_client_rx().
Then server send() return error.

Fix:
add lc_done sem to client

Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-22 14:07:12 +03:00
ligd
e489a308c8 local_socket: remove error log when use nonblock mode
Signed-off-by: ligd <liguiding1@xiaomi.com>
2022-07-22 14:07:12 +03:00
Denis Tolstov
e937cfcbce net/slip: Rename and clarify orphaned Kconfig options 2022-07-20 13:17:09 +08:00
Xiang Xiao
2166c98809 Add printflike and scanflike to all printf/scanf like functions
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
2022-07-18 14:14:36 +03:00
larry
8f72799e8e net: Fix frame count check fail
bc_rxtail/rxtail should always point to newly frame.
If input more than one frame before receive,
missing assignment can result in old frame lost.

Signed-off-by: larry <larry@transtekcorp.com>
2022-07-14 22:56:05 +03:00
Gustavo Henrique Nihei
3948736c41 net: Convert DEBUGASSERT(false) into more intuitive DEBUGPANIC()
Signed-off-by: Gustavo Henrique Nihei <gustavo.nihei@espressif.com>
2022-07-14 12:08:45 +08:00
chao.an
1c80675e87 net/tcp: fix regression of invalid update the rexmit_seq in buffer mode
fix regression of invalid update the rexmit_seq in buffer mode
rexmit_seq should not be used instead of sndseq in fast retransmission,
sndseq of retransmission in the packet does not need to be re-updated

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-07-12 11:04:39 +03:00
chao.an
8ae8c10954 net/poll: fix race condition if connect free before poll teardown
Net poll teardown is not protected by net lock, if the conn is released
before teardown, the assertion failure will be triggered during free dev
callback, this patch will add the net lock around net poll teardown to
fix race condition

nuttx/libs/libc/assert/lib_assert.c:36
nuttx/net/devif/devif_callback.c:85
nuttx/net/tcp/tcp_netpoll.c:405
nuttx/fs/vfs/fs_poll.c:244
nuttx/fs/vfs/fs_poll.c:500

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-07-09 19:11:42 +08:00
chao.an
9bdeed73e2 net/tcp: fix assertion of fallback connection alloc
When the free connection list is unenough to alloc a new instance,
the TCP stack will reuse the currently closed connection, but if
the handle is not released by the user via close(2), the reference
count of the connection remains in a non-zero value, it will cause
the assertion to fail, so when the handle is not released we should
not use such a conn instance when being actively closed, and ensure
that the reference count is assigned within the net lock protection

|(gdb) bt
|#0  up_assert (filename=0x565c78f7 "tcp/tcp_conn.c", lineno=771) at sim/up_assert.c:75
|#1  0x56566177 in _assert (filename=0x565c78f7 "tcp/tcp_conn.c", linenum=771) at assert/lib_assert.c:36
|#2  0x5657d620 in tcp_free (conn=0x565fb3e0 <g_tcp_connections>) at tcp/tcp_conn.c:771
|#3  0x5657d5a1 in tcp_alloc (domain=2 '\002') at tcp/tcp_conn.c:700
|#4  0x565b1f50 in inet_tcp_alloc (psock=0xf3dea150) at inet/inet_sockif.c:144
|#5  0x565b2082 in inet_setup (psock=0xf3dea150, protocol=0) at inet/inet_sockif.c:253
|#6  0x565b1bf0 in psock_socket (domain=2, type=1, protocol=0, psock=0xf3dea150) at socket/socket.c:121
|#7  0x56588f5f in socket (domain=2, type=1, protocol=0) at socket/socket.c:278
|#8  0x565b11c0 in hello_main (argc=1, argv=0xf3dfab10) at hello_main.c:35
|#9  0x56566631 in nxtask_startup (entrypt=0x565b10ef <hello_main>, argc=1, argv=0xf3dfab10) at sched/task_startup.c:70
|#10 0x565597fa in nxtask_start () at task/task_start.c:134

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-07-09 09:37:49 +09:00
YAMAMOTO Takashi
19eb4d7d77 Revert "net/tcp: discard connect reference before free"
This reverts commit b88a1fd7fd. [1]

Because:

* It casues assertion failures like [2].

* I don't understand what it attempted to fix.

[1]
```
commit b88a1fd7fd
Author: chao.an <anchao@xiaomi.com>
Date:   Sat Jul 2 13:17:41 2022 +0800

    net/tcp: discard connect reference before free

    connect reference should be set to 0 before free

    Signed-off-by: chao.an <anchao@xiaomi.com>
```

[2]
```
    #0  up_assert (filename=0x5516d0 "tcp/tcp_conn.c", lineno=771) at sim/up_assert.c:75
    #1  0x000000000040a4bb in _assert (filename=0x5516d0 "tcp/tcp_conn.c", linenum=771) at assert/lib_assert.c:36
    #2  0x000000000042a2ad in tcp_free (conn=0x597fe0 <g_tcp_connections+384>) at tcp/tcp_conn.c:771
    #3  0x000000000053bdc2 in tcp_close_disconnect (psock=0x7f58d1abbd80) at tcp/tcp_close.c:331
    #4  0x000000000053bc69 in tcp_close (psock=0x7f58d1abbd80) at tcp/tcp_close.c:366
    #5  0x000000000052eefe in inet_close (psock=0x7f58d1abbd80) at inet/inet_sockif.c:1689
    #6  0x000000000052eb9b in psock_close (psock=0x7f58d1abbd80) at socket/net_close.c:102
    #7  0x0000000000440495 in sock_file_close (filep=0x7f58d1b35f40) at socket/socket.c:115
    #8  0x000000000043b8b6 in file_close (filep=0x7f58d1b35f40) at vfs/fs_close.c:74
    #9  0x000000000043ab22 in nx_close (fd=9) at inode/fs_files.c:544
    #10 0x000000000043ab7f in close (fd=9) at inode/fs_files.c:578
```
2022-07-08 16:11:24 +08:00
zhanghongyu
c7c5c75451 net_if: add IFF_LOOPBACK/POINTOPOINT/MULTICAST/BROADCAST
Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
2022-07-03 09:57:10 -04:00
chao.an
58dcee641e net/netdev: move netdev_ifup/down to public header
Signed-off-by: chao.an <anchao@xiaomi.com>
2022-07-03 02:28:50 +08:00
chao.an
b88a1fd7fd net/tcp: discard connect reference before free
connect reference should be set to 0 before free

Signed-off-by: chao.an <anchao@xiaomi.com>
2022-07-02 16:07:34 +08:00