Gregory Nutt 5692e340ab Move comments describing a problem out of the code and into the TODO list where it belongs.

2017-10-25 12:37:02 -06:00

..

Kconfig

…

Make.defs

…

tcp_accept.c

…

tcp_appsend.c

…

tcp_backlog.c

…

tcp_callback.c

…

tcp_conn.c

…

tcp_connect.c

Move comments describing a problem out of the code and into the TODO list where it belongs.

2017-10-25 12:37:02 -06:00

tcp_devpoll.c

…

tcp_finddev.c

…

tcp_input.c

…

tcp_ipselect.c

…

tcp_listen.c

…

tcp_monitor.c

TCP Networking: When CONFIG_NET_TCP_WRITE_BUFF=y there is a situation where a NULL pointer may be dereferenced. In this configuration, the TCP connection's 'semi-permnanent' callback, s_sndcb was nullified in tcp_close_disconnect. However, other logic in tcp_lost_connection() attempt to use that callback reference after it was nullifed. Fixed in tcp_lost_connectino() by adding a NULL pointer change before the access. This was reported by Dmitriy Linikov in Bitbucket Issue 72.

2017-10-13 06:47:40 -06:00

tcp_netpoll.c

There was a possible recursion that could eventually overflow the stack. The error occurred when closing the socket with inet_close() while a socket callback was still queued. When the socket callback was executed by devif_conn_event(), this resulted in a call to psock_send_eventhandler() with TCP_CLOSE flag set which then called tcp_lost_connection(). tcp_shutdown_monitor() then called tcp_callback() again, which again called psock_send_eventhandler(), and so on.... Noted by Pascal Speck. Solution is also similar to a solution proposed by Pascal Speck.

2017-10-19 11:55:51 -06:00

tcp_send_buffered.c

There was a possible recursion that could eventually overflow the stack. The error occurred when closing the socket with inet_close() while a socket callback was still queued. When the socket callback was executed by devif_conn_event(), this resulted in a call to psock_send_eventhandler() with TCP_CLOSE flag set which then called tcp_lost_connection(). tcp_shutdown_monitor() then called tcp_callback() again, which again called psock_send_eventhandler(), and so on.... Noted by Pascal Speck. Solution is also similar to a solution proposed by Pascal Speck.

2017-10-19 11:55:51 -06:00

tcp_send_unbuffered.c

Fix an error introduced in last commit.

2017-10-19 16:26:09 -06:00

tcp_send.c

…

tcp_sendfile.c

tcp_lost_connection() is called from two places in tcp_sendfile.c

2017-10-19 16:36:57 -06:00

tcp_seqno.c

…

tcp_timer.c

…

tcp_wrbuffer_dump.c

…

tcp_wrbuffer.c

…

tcp.h

…