H750+Lwip2.0.3+FreeRTOS Ping大包会丢包，清空分片包链的时候会跑飞

24540477zxc

1. static int
   
2. ip_reass_free_complete_datagram(struct ip_reassdata *ipr, struct ip_reassdata *prev)
   
3. {
   
4.   u16_t pbufs_freed = 0;
   
5.   u16_t clen;
   
6.   struct pbuf *p;
   
7.   struct ip_reass_helper *iprh;
   
8. 
   
9.   LWIP_ASSERT("prev != ipr", prev != ipr);
   
10.   if (prev != NULL) {
    
11.     LWIP_ASSERT("prev->next == ipr", prev->next == ipr);
    
12.   }
    
13. 
    
14.   MIB2_STATS_INC(mib2.ipreasmfails);
    
15. #if LWIP_ICMP
    
16.   iprh = (struct ip_reass_helper *)ipr->p->payload;
    
17.   if (iprh->start == 0) {
    
18.     /* The first fragment was received, send ICMP time exceeded. */
    
19.     /* First, de-queue the first pbuf from r->p. */
    
20.     p = ipr->p;
    
21.     ipr->p = iprh->next_pbuf;
    
22.     /* Then, copy the original header into it. */
    
23.     SMEMCPY(p->payload, &ipr->iphdr, IP_HLEN);
    
24.     icmp_time_exceeded(p, ICMP_TE_FRAG);
    
25.     clen = pbuf_clen(p);
    
26.     LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    
27.     pbufs_freed = (u16_t)(pbufs_freed + clen);
    
28.     pbuf_free(p);
    
29.   }
    
30. #endif /* LWIP_ICMP */
    
31. 
    
32.   /* First, free all received pbufs.  The individual pbufs need to be released
    
33.      separately as they have not yet been chained */
    
34.   p = ipr->p;
    
35.   while (p != NULL) {
    
36.     struct pbuf *pcur;
    
37.     iprh = (struct ip_reass_helper *)p->payload;
    
38.     pcur = p;
    
39.     /* get the next pointer before freeing */
    
40.     p = iprh->next_pbuf;
    
41.     clen = pbuf_clen(pcur);
    
42.     LWIP_ASSERT("pbufs_freed + clen <= 0xffff", pbufs_freed + clen <= 0xffff);
    
43.     pbufs_freed = (u16_t)(pbufs_freed + clen);
    
44.     pbuf_free(pcur);
    
45.   }
    
46.   /* Then, unchain the struct ip_reassdata from the list and free it. */
    
47.   ip_reass_dequeue_datagram(ipr, prev);
    
48.   LWIP_ASSERT("ip_reass_pbufcount >= pbufs_freed", ip_reass_pbufcount >= pbufs_freed);
    
49.   ip_reass_pbufcount = (u16_t)(ip_reass_pbufcount - pbufs_freed);
    
50. 
    
51.   return pbufs_freed;
    
52. }

复制代码

现象：ping超过mtu的字节数时，分片数据丢包，导致开启reass定时器，这里进入上面的函数来释放分片数据链，通过 (struct ip_reass_helper *)p->payload来释放分片包，但这里会指向异常地址，导致hardfault。工具：IAR

翼行园子

帮顶！！

陈其旦

楼主问题解决了嘛

24540477zxc

陈其旦 发表于 2019-9-23 16:26
楼主问题解决了嘛

并没有啊，先暂时关闭接收分片了

24540477zxc

自顶，卡在这里很久了

07lhluo

楼主，你好。我用打印寄存器的方式判定异常也是跟你的问题一模一样，能否加为好友以前探讨一下这个技术问题？

07lhluo

楼主，请试试这个：
https://savannah.nongnu.org/bugs ... m&item_id=38210

07lhluo

楼主，请试试这个药方：
https://savannah.nongnu.org/bugs ... m&item_id=38210
如果药方有效，请一定要回来答复一下，谢谢！

wub530906

楼主你好，最近也在调试网络能否添加好友，相互探讨

07lhluo

我这边有一个项目，现场用了70多台这样的设备。接到的反馈是，总有5-10台设备运行3-14天就完全没有反应，重启就正常。哪台设备，能正常运行多少天才死机，是随机的。后来最终定位是Lwip处理分片包数据确实是有BUG。经过3个月的时间，我修复了这个问题。其中包括长期运行了仅2个月来验证修复效果，没有一台出问题了。这里提供我的解决方案，大家可参考：
static int
ip_reass_remove_oldest_datagram(struct ip_hdr *fraghdr, int pbufs_needed)
{
  /* @ToDo Can't we simply remove the last datagram in the
   *       linked list behind reassdatagrams?
   */
  struct ip_reassdata *r, *oldest, *prev, *oldest_prev;
  int pbufs_freed = 0, pbufs_freed_current;
  int other_datagrams;

  /* Free datagrams until being allowed to enqueue 'pbufs_needed' pbufs,
   * but don't free the datagram that 'fraghdr' belongs to! */
  do {
    oldest = NULL;
    prev = NULL;
    oldest_prev = NULL;
    other_datagrams = 0;
    r = reassdatagrams;
    while (r != NULL) {
      if (!IP_ADDRESSES_AND_ID_MATCH(&r->iphdr, fraghdr)) {
        /* Not the same datagram as fraghdr */
        other_datagrams++;
        if (oldest == NULL) {
          oldest = r;
          oldest_prev = prev;
        } else if (r->timer <= oldest->timer) {
          /* older than the previous oldest */
          oldest = r;
          oldest_prev = prev;
        }
      }
      if (r->next != NULL) {
        prev = r;
      }
      r = r->next;
    }

//    if (oldest != NULL) {
        //fix 如果待删除的是头结点，而oldest->next 节点不能为空；
        // 否则运行ip_reass_dequeue_datagram(ipr, prev)后，将导致删掉头结点后
        // 头结点指向NULL；
        if (oldest != NULL && (!(oldest==reassdatagrams && oldest->next==NULL))) {
      pbufs_freed_current = ip_reass_free_complete_datagram(oldest, oldest_prev);
      pbufs_freed += pbufs_freed_current;
    }
  }        
  
//  while ((pbufs_freed < pbufs_needed) && (other_datagrams > 1));
       
  while (((pbufs_freed < pbufs_needed) && (other_datagrams > 1))
          && (!(oldest==reassdatagrams && NULL==oldest_prev))
          && (!(oldest==NULL && oldest_prev==NULL)));//迫使程序务必不要删掉头结点的数据；

  return pbufs_freed;
}