libtun2socks tcp_free_acked_segments: lwip assertion failure: tcp_receive: valid queue length

[ghost]

Please read contributing guidelines. Thanks.

Describe the bug

I check /data/tombstones today, find out a lot of "out of UDP buffer" error produced by shadowsocks libtun2sock.so. Since it happened several days ago, I have no idea how to reproduce it.

Expected behavior
A clear and concise description of what you expected to happen.
No errors.

Smartphone (please complete the following information):

• Android/Chrome OS version: official lineage os 16.
• Device: mi 6
• Version: latest beta
• Last version that did not exhibit the issue: [not applicable]

[ghost]

might relate to ambrop72/badvpn#41

[Mygod]

Please post full tombstones here. The link you post relates to an error log and should not cause a crash.

[ghost]

tombstone_00.txt

FYI

[Mygod]

Memory near stack: tcp_free_acked_segments: lwip assertion failure: tcp_receive: valid queue length

https://github.com/shadowsocks/badvpn/blob/6e14849aa213cbb028aeb0c75905438260fd867c/lwip/src/core/tcp_in.c#L1093

@madeye What do you think?

[madeye]

It looks kind of out of memory error?

[ghost]

@madeye some useful information http://lwip.100.n7.nabble.com/memory-leak-td24546.html

"Hi,

PROBLEM SOLVED :-)

As mentioned earlier by Sergio we should not call LwIP code from within
other threads.

I must call tcp_write and other functions from a separate thread. This
is the implementation.

My TCP stack has the highest task priority in the system. As a result
calling tcp_write or any other
LwIP function may cause unpredictable LwIP internal code problems.

I added taskENTER_CRITICAL(); and taskEXIT_CRITICAL();
Function calls to the portion of code that call tcp_write etc.. this
synchronizes the threads
Interaction and solved the problem I faced completely. "

[Mygod]

Indeed I seem to find a similar tombstone on my device as well (1 out of 10 crash is from tun2socks, and the other 9 is from Pokemon Go :fitness). It seems like a rare race condition or sort. We should probably report this to upstream.

[MegatronKing]

This seems to be an issue with MI 6. My project encountered a similar issue. After the VPN service was started, the VPN descriptor received a large number of UDP packets sent to the router. The IP of each packet is incremented, such as from 192.168.1.1-192.168.1.254 and the port is 137.

[Mygod]

@madeye According to Crashlytics, this issue occurs across virtually any device (~10k events daily now), including Google Pixels, but (somehow) more frequently in Xiaomi. Unfortunately, 89dee85 is only set up since v4.8.1 so I cannot be sure which version introduced this bug but I suspect that it exists a long time ago.

We should probably report this to upstream.

[madeye]

Try this APK: https://www.dropbox.com/s/0woejj6iqrvrh9u/shadowsocks-4.8.3-nightly-universal-release.apk

[Mygod]

I've been running with this patch for a few hours now and it seems fine. (however, my last tombstone from this crash was ~40 hours ago)

EDIT: Another 25 hours passed. Still good.

[Mygod]

@madeye I think it should be fixed. Why don't we just do a new release and look at Crashlytics? 😄

[madeye]

Sure, I'll schedule a release today.

[Mygod]

Seems to be fixed.