diff options
| author | user <user@clank> | 2026-07-17 20:22:07 +0200 |
|---|---|---|
| committer | user <user@clank> | 2026-07-17 20:22:07 +0200 |
| commit | d94b18652ddfb264aa9a34514ea790230d80bcc2 (patch) | |
| tree | fd7de936064289ac064070238bd2118e296c73c0 /src | |
| parent | docs: link-drop investigation resolved - drops are self-healing now (diff) | |
| download | gbos-d94b18652ddfb264aa9a34514ea790230d80bcc2.tar.gz gbos-d94b18652ddfb264aa9a34514ea790230d80bcc2.tar.xz gbos-d94b18652ddfb264aa9a34514ea790230d80bcc2.zip | |
net: fix truncated TCP field offsets corrupting multi-segment recv
SK_STATE/SK_SND/SK_RCV sat at struct offsets 305/306/310, past the
288-byte SK_RXBUF. But the field accessors add the offset as an 8-bit
immediate (add SK_x; ld l,a), so rgbasm truncated 305->49, 306->50,
310->54 (the -Wtruncation warnings we'd been ignoring) - putting STATE
and the sequence numbers *inside* RXBUF at offsets 49/50/54.
Any TCP segment with >=33 payload bytes therefore overwrote the
connection's own STATE and rcv_nxt/snd_nxt with message text. The first
segment of a stream landed, its data clobbered STATE to a garbage value,
and every subsequent segment was dropped because tcp_in no longer saw
ESTABLISHED - so multi-segment TCP receives (an IRC MOTD, any HTTP body
past one segment) silently stalled. wget appeared to 'work' only because
a single-segment reply plus a never-honored FIN still printed once.
Fix: reorder the struct so STATE/SND/RCV precede the big RXBUF, keeping
every field offset < 256 (SK_SIZE unchanged at 314, all accessors are
symbolic). Zero -Wtruncation warnings remain. Verified an 11-line IRC
registration burst now arrives intact.
Diffstat (limited to 'src')
| -rw-r--r-- | src/socket.asm | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/src/socket.asm b/src/socket.asm index 20ed982..0720b0a 100644 --- a/src/socket.asm +++ b/src/socket.asm @@ -21,10 +21,16 @@ DEF SK_HASRX EQU 9 ; 1 rxbuf holds a datagram DEF SK_RXLEN EQU 10 ; 1 payload length DEF SK_SRCIP EQU 11 ; 4 sender IP DEF SK_SRCPORT EQU 15 ; 2 sender port -DEF SK_RXBUF EQU 17 ; 288 payload (holds a DHCP reply, or a max segment) -DEF SK_STATE EQU 305 ; 1 TCP state (see TCP_* below) -DEF SK_SND EQU 306 ; 4 snd_nxt (our next sequence number) -DEF SK_RCV EQU 310 ; 4 rcv_nxt (next sequence we expect from peer) +; TCP bookkeeping MUST stay below offset 256: the field accessors do +; `add SK_x` as an 8-bit immediate, so any constant >=256 is silently +; truncated (e.g. 305 -> 49) and lands *inside* RXBUF, where an incoming +; segment's payload then overwrites the connection's STATE/seq numbers - +; corrupting every multi-segment TCP receive. Keep STATE/SND/RCV ahead of +; the big RXBUF; RXBUF is only ever based via a 16-bit-safe add. +DEF SK_STATE EQU 17 ; 1 TCP state (see TCP_* below) +DEF SK_SND EQU 18 ; 4 snd_nxt (our next sequence number) +DEF SK_RCV EQU 22 ; 4 rcv_nxt (next sequence we expect from peer) +DEF SK_RXBUF EQU 26 ; 288 payload (holds a DHCP reply, or a max segment) DEF SK_SIZE EQU 314 DEF TCP_MSS EQU 200 |