LWIP_ASSERT on pbuf_free function

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

LWIP_ASSERT on pbuf_free function

2,542 Views
biafra
Senior Contributor I

Hi everyone,

I'm using MCUXpresso 10.2.1 and a custom board based on MK65F2M0 chip.
I have a problem on using LwIP: it sometimes crash generating an assert, because of some invalid parameter.

The workflow is:

  • The board is configured with a main connection using a GPRS modem and an optional second LAN connection
  • Every about 15 seconds the board connects to a server and sends two types of packets, one smaller and one a little bigger. The bigger one is sended once every 3/4 times typically
  • Most of the time the server closes the connection (if no operation on the device is requested), but sometimes it can go ahead in the session, exchanging some data (if an operation on the device is requested). In this debug session the server closes the connection every time
  • The problem is that after a while (5 minutes mean, but sometimes after 20 minutes), the board generates an assertion on releasing a network buffer, because it seems that is trying to free a buffer already freed

Here is a snippet of code:

   int sock;
   int opt;
   struct sockaddr_in outerdata;
   int rn;

   outerdata.sin_addr.s_addr = htonl( address );
   outerdata.sin_family = AF_INET;
   outerdata.sin_port = htons( port );
   sock = socket( AF_INET, SOCK_STREAM, 0 );

   //set non blocking
   opt = 1;
   ioctl( sock, FIONBIO, &opt );

   connect( sock, ( struct sockaddr * )&outerdata, sizeof( outerdata )))

   //set blocking
   opt = 0;
   ioctl( sock, FIONBIO, &opt );

   send( sock, &data, sizeof( data ), 0 );

   struct timeval tv;
   tv.tv_sec = 2; /* 2 Secs Timeout */
   tv.tv_usec = 0;

   setsockopt( sock, SOL_SOCKET, SO_RCVTIMEO, ( const void * )&tv, sizeof( struct timeval ));

   //total timeout: 10 s
   for( i = 0; i < 5; i++ )
   {
      rn = recv( sock, ( void * )&rxdata, sizeof( rxdata ), 0 );
      if(( errno == EAGAIN ) && ( rn < 0 ))
      {
         PRINTF( "WAIT SERVER\n" );
         continue;
      }
      if( rn < 0 )
      {
         PRINTF( "ERRORE %d ON RECV\n", errno );
         break;
      }
      if( rn == 0 )
      {
         PRINTF( "CONNECTION CLOSED\n" );
         break;
      }
      goto rx_ok;
   }
   closesocket( sock );
   return( rn );

rx_ok:;

   //exchange data
   ...

The problem occurs only when the bigger packet is sent and the first timeout occurred on the recv function (I can see the "WAIT SERVER" message on the debug monitor only once), but it doesn't occurs all the times these conditions are present.
The assertion occurs on the pbuf_free() function at the instruction LWIP_ASSERT("pbuf_free: p->ref > 0", p->ref > 0);

The image below shows the Wireshark captured session of the smaller packet:

pastedImage_1.png

The image below shows the Wireshark captured session of the bigger packet:

pastedImage_2.png

The image below shows the Wireshark captured session of the error condition; note that the TCP Retransmission packets are present because the device is stopped on the breakpoint:

pastedImage_3.png

I enabled statistics on LwIP and all used resources are below the limits.

How can I debug this situation?

Many thanks
Biafra

7 Replies

1,843 Views
biafra
Senior Contributor I

Hi everyone,

This is another situation maybe caused by the same issue:

pastedImage_1.png

Something to notice in the memp_TCP_SEG variable: the stats struct shows that no element is now used and the maximum number of elements ever used from the application start is 3. The tab variable points to the linked list of all free elements: having now no used elements, the linked list should link all the elements (26), but as it can be seen, there is only one element in the list.

How can it be generated?

Many thanks

Biafra

1,843 Views
danielchen
NXP TechSupport
NXP TechSupport

Hi biafra:

Which MCUXpresso SDK version you are using?

Do you use Redlib or Newlib in your project?

How many tasks in your system, and does the two types of packets send by one task or by two different tasks?

Could you please make a simple project that can run on  a TWR-K65 board to reproduce this issue?

Regards

Daniel

1,843 Views
biafra
Senior Contributor I

Hi danielchen@fsl,

I use MCUXpresso SDK version 2.3.

The library is Redlib (nohost-nf).

The application runs about 30 tasks, it's always the same task that sends the two types of packet.

Unfortunately I'm not able to reproduce the issue on TWR..

Many thanks

Biafra

1,843 Views
danielchen
NXP TechSupport
NXP TechSupport

Hi Biafra:

It is not easy to trace this issue. But I would suggest you try newlib to see whether it helps. Since Reblib is not thread safe.

newlib has a patch for another issue, that will be available in next MCUXpresso SDK release.

Regards

Daniel

1,843 Views
biafra
Senior Contributor I

Hi danielchen@fsl‌,

Unfortunately newlibnano works as redlib.

I've tried even newlib, but the application crash the first time the snprintf() function is called.

How can I find the issue?

Many thanks

Biafra

1,843 Views
danielchen
NXP TechSupport
NXP TechSupport

Hi biafra

This issue is from Customer Dave. Thanks Dave.  Please refer to the details from below link.

newlib and FreeRTOS 

I would suggest you try to use Dave's work around to see whether it helps.

This new release will be available at the early of 2019.

Regards

Daniel

1,843 Views
biafra
Senior Contributor I

Hi danielchen@fsl,

Thanks for your suggestion.

Now I'm trying with newlibnano, I'll let you know how it works.

Meanwhile, can you tell me what is the issue and when will next MCUXpresso SDK release be available?

Many thanks,

Biafra