[lwip-devel] [bug #48543] TCP sent callback may prematurely report sent data when only part of a segment is acked

[Ambroz Bizjak]

Follow-up Comment #2, bug #48543 (project lwip):

Hi Simon,

Indeed the assumption is that the application leaves the buffer unchanged
until lwIP reports (via sent callback and/org tcp_sndbuf) that the bytes have
been acked.

The issue is that the peer can ACK only part of a segment. E.g. suppose lwIP
sends a segment with sequence number 100 which is 50 bytes long so it
corresponds to sequence numbers [100,150), but the peer sends an ACK number of
120. In this case the current logic in lwIP will report the 20 bytes as acked
to the application. But the segment/pbuf will not be freed since it hasn't
been acked in its entirety. lwIP still references the  segment and may
retransmit it in its entirety. While it is being retransmitted the application
may be writing new data to the 20-byte portion of it.

I am making a fix for this in my lwIP fork right now.

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?48543>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/