search

zephyrproject-rtos / zephyr

Primary Git Repository for the Zephyr Project. Zephyr is a new generation, scalable, optimized, secure RTOS for multiple hardware architectures.
https://docs.zephyrproject.org
Apache License 2.0
10.86k stars 6.62k forks source link

echo server hangs from IPv6 hop-by-hop option anomaly #3741

Closed zephyrbot closed 7 years ago

zephyrbot commented 7 years ago

Reported by Ruslan Mstoi:

Defensics test case IPv6.IPv6.ICMPv6.Echo-Request.IPv6-Packet.payload.ipv6-extension-header.header-hop-by-hop-options.options.ipv6-option.option.option-experimental-3e.type #11497

Packet with anomaly in IPv6 hop-by-hop option causes echo server to hang and stop responding.

Attached pcap can be used to replay this issue.

(Imported from Jira ZEP-2306)

zephyrbot commented 7 years ago

by Ruslan Mstoi:

zephyrbot commented 7 years ago

by Ruslan Mstoi:

zephyrbot commented 7 years ago

by Ruslan Mstoi:

zephyrbot commented 7 years ago

by Ruslan Mstoi:

zephyrbot commented 7 years ago

by Ruslan Mstoi:

With most recent version of Zephyr echo server does not hang anymore. But error message is printed:

[net/net_pkt] [ERR] net_pkt_unref_debug: ERROR frag 0x01040302 is freed already (ns_reply_timeout():276)

Also, this results in a memory leak:

shell> net mem Fragment length 128 bytes Network buffer pools: Name Size Count Avail Address RX 8000 100 100 0x0011ff10 TX 8000 100 100 0x0011ff2c RX DATA (rx_bufs) 14400 100 88 0x0011ff70 TX DATA (tx_bufs) 14400 100 100 0x0011ff9c

zephyrbot commented 7 years ago

by Ruslan Mstoi:

Attached ipv6-hop-by-hop-linux-dut.pcapng capture of running this test cases with Linux IUT. Hop-by-hop option is not present in echo reply.

zephyrbot commented 7 years ago

by Ruslan Mstoi:

Attached ipv6-hop-by-hop-zephyr-dut.pcapng capture of running this case with Zephyr DUT. Wireshark shows error message for echo reply: "Checksum: 0x06c2 [incorrect, should be 0x05c2]"

zephyrbot commented 7 years ago

by Jukka Rissanen:

https://github.com/zephyrproject-rtos/zephyr/pull/691