Don't call pbuf_free when ethernet_input is Ok

[Slion]

Operating System

Others

Board

Raspberry Pi Pico WH

Firmware

net_lwip_webserver

What happened ?

If you call pbuf_free on the frame when ethernet_input returns ERR_OK you will get either panic with assert pbuf_free: p->ref > 0 or worst steal the buffer ownership from the HTTP server.

How to reproduce ?

Try run net_lwip_webserver on Pico.

Debug Log as txt file (LOG/CFG_TUSB_DEBUG=2)

Sorry won't bother, description is good enough.

Screenshots

lwIP ticket: https://savannah.nongnu.org/patch/index.php?10121
See example of how it should be done: https://github.com/lwip-tcpip/lwip/blob/master/contrib/examples/ethernetif/ethernetif.c
Here is the faulty code:

tinyusb/examples/device/net_lwip_webserver/src/main.c

Line 198 in 6bfd024

pbuf_free(received_frame);

I have checked existing issues, dicussion and documentation

• I confirm I have checked existing issues, dicussion and documentation.

[HiFiPhile]

Hi, only few of mainteners are good at lwip, do you any suggestion how to fix it ?

[Slion]

Hi, only few of mainteners are good at lwip, do you any suggestion how to fix it ?

/// @brief Perform network tasks, process packets
/// @param
void service_traffic(void)
{
    /* handle any packet received by tud_network_recv_cb() */
    if (received_frame)
    {
        // Surrender ownership of our pbuf unless there was an error
        // Only call pbuf_free if not Ok else it will panic with "pbuf_free: p->ref > 0" 
        // or steal it from whatever took ownership of it with undefined consequences.
        // See: https://savannah.nongnu.org/patch/index.php?10121
        if (ethernet_input(received_frame, &netif_data)!=ERR_OK) {
            pbuf_free(received_frame);
        }
        received_frame = NULL;
        tud_network_recv_renew();
    }

    sys_check_timeouts();
}

[HiFiPhile]

Thank you , PR is on: #2829