Re: [PATCH v2 2/3] net: lwip: wget: free the transfer context after an aborted request

Hi Jerome,

On 14.08.26 16:28, Jerome Forissier wrote:
> Hi Shahriyar,
>
> On 13/08/2026 18:28, Shahriyar Jalayeri wrote:
>> wget_do_request() keeps the transfer context on the stack and passes its
>> address to the lwIP httpc callbacks. If the user interrupts the transfer
>> with Ctrl-C while the host name is still resolving, wget_handle_request()
>> leaves its receive loop without tearing the connection down. The pending
>> DNS lookup (which lwIP cannot cancel) later resolves, the connection is
>> established, and httpc_recv_cb() runs against a stack frame that no longer
>> exists. It writes attacker-controlled TCP data through store_block() to
>> map_sysmem(ctx->daddr), with ctx read from reused stack.
>>
>> The httpc_connection_t passed to httpc_get_file_dns() has the same lifetime
>> problem. lwIP stores a pointer to it in httpc_state_t.conn_settings rather
>> than a copy, and dereferences that pointer later for the result and
>> headers-done callbacks, so an abandoned request reads its result_fn and
>> headers_done_fn from a stack frame that is gone.
>>
>> Allocate the context on the heap, move the connection settings into it
>> (along with the TLS allocator the settings point at, so nothing lwIP
>> retains points back at the stack), and add an 'abandoned' flag. On Ctrl-C
>> with a request still in flight, mark it abandoned and hand ownership to the
>> lwIP callback, which frees the context when the connection finally tears
>> down; the receive, headers-done and result callbacks return early so a
>> stale callback neither stores data nor touches wget_info.
> The problem I see is that this relies on a later callback to reclaim the
> heap context, but that callback is not guaranteed to run, especially once
> the command removes the netif and stops the device. That fixes the UAF by
> extending the lifetime, but can turn Ctrl-C into a leak.
>
> I suggest cancelling the in-flight lwIP operation before returning from
> wget, while the stack objects are still valid. That likely means adding a
> small DNS callback cancellation helper and an httpc_abort() helper, then
> calling it on Ctrl-C and freeing the TLS config before returning.
>
> Thanks,


Agreed, the heap can leak on Ctrl-C. I looked at cancelling, and from 
what I understand lwIP exposes no way to do it today, So both helpers 
are new lwIP API, and since lib/lwip/lwip is a vendored upstream import 
I'd like your call, upstream to lwIP first, or add them U-Boot-local?

Thanks,
Shah