From b738b2ff1b7a0b60ee81c2fcf07e6d66931553e8 Mon Sep 17 00:00:00 2001 From: Evgeny Date: Thu, 2 Jul 2026 12:57:21 +0300 Subject: [PATCH] etcp_router: add u_check guards at send_q/recv_q entry points to detect memory corruption --- src/etcp_router.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/etcp_router.c b/src/etcp_router.c index af00b065..411a99ce 100644 --- a/src/etcp_router.c +++ b/src/etcp_router.c @@ -212,7 +212,9 @@ static void router_drain_send_q(struct ETCP_ROUTER_CONN* rconn) { if ((int32_t)(rconn->tx_seq - rconn->tx_acked) >= ROUTER_MAX_INFLIGHT) break; struct ll_entry* e = queue_data_get(rconn->send_q); if (!e) { rconn->send_blocked = 0; break; } + u_check(e, "drain:after_get", "router"); int s_err = router_send_one(rconn, e->dgram, e->len); + u_check(e, "drain:after_send", "router"); queue_dgram_free(e); queue_entry_free(e); if (s_err != 0 && (int32_t)(rconn->tx_seq - rconn->tx_acked) >= ROUTER_MAX_INFLIGHT) break; } @@ -246,6 +248,7 @@ static int router_enqueue_send(struct ETCP_ROUTER_CONN* rconn, const uint8_t* pa DEBUG_DEBUG(DEBUG_CATEGORY_ETCPROUTE, "router_send_q: queued svc_id=%u inflight=%d send_q=%d", rconn->svc_id, (int32_t)(rconn->tx_seq - rconn->tx_acked), queue_entry_count(rconn->send_q)); queue_data_put(rconn->send_q, qe); + u_check(qe, "enqueue_send:after_put", "router"); rconn->send_blocked = 1; if (!rconn->send_resume_timer) rconn->send_resume_timer = uasync_set_timeout(rconn->inst->ua, @@ -746,11 +749,11 @@ void etcp_router_conn_restart(struct UTUN_INSTANCE* inst, uint64_t remote_node_i struct ll_entry* f; if (rconn->send_q) { - while ((f = queue_data_get(rconn->send_q)) != NULL) { queue_dgram_free(f); queue_entry_free(f); } + while ((f = queue_data_get(rconn->send_q)) != NULL) { u_check(f, "restart:send_q", "router"); queue_dgram_free(f); queue_entry_free(f); } queue_free(rconn->send_q); } if (rconn->recv_q) { - while ((f = queue_data_get(rconn->recv_q)) != NULL) { queue_dgram_free(f); queue_entry_free(f); } + while ((f = queue_data_get(rconn->recv_q)) != NULL) { u_check(f, "restart:recv_q", "router"); queue_dgram_free(f); queue_entry_free(f); } queue_free(rconn->recv_q); } rconn->send_q = queue_new(inst->ua, 0, 0, 0, "router_send_q");