Hi,
I'm running a tcp server using LWIP and upon termination of the connection, both sides do a "shutdown(sock, SHUT_WR)", wait for recv to return 0, call "shutdown(sock, SHUT_RDWR)", call "close(sock)".
The bug occurs in form of a race condition:
- the lwip server calls SHUT_WR
- the client calls SHUT_WR, once lwip saw this, it sets TF_RXCLOSED in "pcb->flags"
- the client closes the connection, lwip sees this, adds TF_CLOSED to recv_flags, and then deletes the pcb within "tcp_input_delayed_close".
The problem here is that "tcp_input_delayed_close" only calls the "pcb->errf" callback on this condition:
"if (!(pcb->flags & TF_RXCLOSED))"
I don't really know why that was done in first place, but because of this, the pcb gets freed without notifying the user(which would set conn->pcb.tcp to NULL) in case the RX side was closed already.
On the next call to shutdown or close, this results in use-after-free.
I'm posting this to the mailing list first instead of the bug tracker to discuss the intention behind the condition and to come up with a proper solution.
Thanks
Michael Zimmermann