Re: [lwip-users] Crash in 'stats_display_memp()'

[Eric Koldeweij]

Gisle,

Normally RAW_PCB is the first one in the list and there should not be 
anything before that. Do you have either LWIP_MALLOC_MEMPOOL or 
LWIP_PBUF_MEMPOOL defined in your code? Do you use custom pools 
(MEMP_USE_CUSTOM_POOLS defined to a nonzero value)? If so, please post 
your lwippools.h.

The code creating the enum is in src/include/lwip/memp.h and it takes 
its items from src/include/lwip/priv/memp_std.h.

try using "gcc -E" to see what the include file expands like when it's 
processed?

Regards,

Eric.

On 12/1/24 14:33, Gisle Vanem via lwip-users wrote:
> Eric Koldeweij wrote:
>
> > Just for the record, you are absolutely sure that lwip_init() has 
> > already been called when using this menu? That would explain the 
> > null-pointer + some_offset....
> >
> > If you have, a small investigation report and some more information 
> > is really needed - you cannot expect us to magically look into your 
> > code. To start with: which LWIP version are you using? What does your 
> > "little lwIp test program" look like? Can you share some of its code 
> > with us? What have you found out yourself already?
> >
> > Further: at which index does the fault occur? What are your 
> > MEMP_NUM_XXXX definitions valued at? Do the other stats work? Has any 
> > traffic already occurred? Without any information I don't think your 
> > issue will be solved any time soon....
>
> Thanks for replying.
>
> Yes, 'lwip_init()' was called and some network traffic was sent
> and received. Tested with Chrome connecting multiple times to the
> lwIP HTTP-server at 10.0.0.23. Works just fine. My 'netstat' shows:
> --------------------------------------------------------------
> Proto  Local                 Remote               Status
> tcp    0.0.0.0:80            -                    LISTEN
> tcp    0.0.0.0:19            -                    LISTEN
> tcp    0.0.0.0:23            -                    LISTEN
> tcp    10.0.0.23:80          10.0.0.10:61437      TIME_WAIT << last 
> Chrome
> tcp    10.0.0.23:80          10.0.0.10:61435      TIME_WAIT << last 
> Chrome
> udp    0.0.0.0:69            0.0.0.0:0            NONE
> udp    0.0.0.0:137           0.0.0.0:0            NONE
>
> I use the latest lwIP version from 'git master'.
>
> My 'MEMP_NUM_x' values in my 'lwipopts.h':
>   #define MEMP_NUM_MLD6_GROUP      4
>   #define MEMP_NUM_ND6_QUEUE       20
>   #define MEMP_NUM_TCP_SEG         150
>   #define MEMP_NUM_SYS_TIMEOUT     17
>   #define MEMP_NUM_NETBUF          10
>   #define MEMP_NUM_NETCONN         100
>   #define MEMP_NUM_TCPIP_MSG_API   16
>   #define MEMP_NUM_TCPIP_MSG_INPKT 16
>   #define MEMP_NUM_REASSDATA       10
>
> Also:
>   #define MEMP_OVERFLOW_CHECK  2
>   #define MEMP_DEBUG           1
>   #define MEMP_SANITY_CHECK    1
>
>
> When I build w/o ASAN, the program crashes at the 1st
> display of 'MEMP_STATS_DISPLAY (0)'. WinDbg shows
> 'mem == 00000000-00001a68' for 'idx == 0'. A bogus
> read-access. But modifying 'stats.c' into:
>
> --- a/src/core/stats.c 2018-12-18 23:03:33
> +++ b/src/core/stats.c 2024-12-01 14:03:09
> @@ -115,7 +115,10 @@
> @@ -115,7 +115,11 @@
>  void
>  stats_display_memp(struct stats_mem *mem, int idx)
>  {
> -  if (idx < MEMP_MAX) {
> +  BOOL  bad = IsBadReadPtr (mem, sizeof(*mem));
> +
> +  if (bad)
> +     LWIP_PLATFORM_DIAG(("MEM at idx %d bad\n", idx));
> +  else if (idx < MEMP_MAX) {
>      stats_display_mem(mem, mem->name);
>    }
>  }
> --------
>
> shows "only" idx = [0..3] as bogus:
>
> MEM at 0 idx bad
> MEM at 1 idx bad
> MEM at 2 idx bad
>
> MEM RAW_PCB
>         avail: 0
>         used: 0
>         max: 0
>         err: 0
> ....
>
> MEM SYS_TIMEOUT
>         avail: 0
>         used: 13
>         max: 13
>         err: 0
>
> MEM NETDB
>         avail: 0
>         used: 0
>         max: 0
>         err: 0
>
> MEM ND6_QUEUE
>         avail: 0
>         used: 0
>         max: 0
>         err: 0
>
> ------------------
>
> So what could be missing at idx 0..3? I seems to have
> some missing 'MEMP_NUM_x' values.
>
> > Can you share some of its code with us?
>
> My test-code is based on 'contrib/examples/example_app/test.c'
> with a lot added stuff.