Re: [lwip-users] Reassembles incoming IP crash my system

[Derek Guerdon]

On Tue, 21 Mar 2006 16:51:12 +0100, Amir wrote:

>It was alignment issue, I have used 4 byte alignment and thus case alignment
>exception (PPC) to occure. 
>In one machine of two machine, which has MPC5200, an alignment exception is
>occure and in the other is just crash, before the exception run, I don't
>know why.
>But as I used 2 byte alignment it work as expected.
>
>-Amir
>
>> I am using lwip under mpc5200 and it work fine, until a client send a 
>> big
>IP
>> packet. In this case the lwip crash on
>> Ip_frag.c: line 263
>> memcpy(q->payload, &ip_reassbuf[i],
>>             q->len > ip_reasslen - i ? ip_reasslen - i : q->len);
>>
>> Then I disable reasemble big IP in lwipopts.h, so that such packets 
>> will
>be
>> droped.
>>
>> It crash in my case by using "ping" like:
>>
>> Ping host -s 1524
>>
>> Is that a bug or I have may forgot something?
>

It sounds like your problem is alignment of reassbuf. Below is a diff
that should force your compiler to align the buffer on the correct
boundary. 

Please note that there are also issues of this same sort in mem.c,
memp.c, and pbuf.c.

Hope this helps:

Index: ip_frag.c
===================================================================
RCS file: /sources/lwip/lwip/src/core/ipv4/ip_frag.c,v
retrieving revision 1.21
diff -r1.21 ip_frag.c
80c80,87
< static u8_t ip_reassbuf[IP_HLEN + IP_REASS_BUFSIZE];
---
> static union
> {
>   struct ip_hdr hdr;
>   u8_t buf[IP_HLEN + IP_REASS_BUFSIZE];
> } reass_mem;
> 
> #define ip_reassbuf reass_mem.buf
> 

-- 
Derek Guerdon