Re: [PATCH v2 2/3] net: lwip: wget: free the transfer context after an aborted request

Hi Shahriyar,

On 19/08/2026 18:56, shj wrote:
> Hi Jerome,
> 
> On 14.08.26 16:28, Jerome Forissier wrote:
>> Hi Shahriyar,
>>
>> On 13/08/2026 18:28, Shahriyar Jalayeri wrote:
>>> wget_do_request() keeps the transfer context on the stack and passes its
>>> address to the lwIP httpc callbacks. If the user interrupts the transfer
>>> with Ctrl-C while the host name is still resolving, wget_handle_request()
>>> leaves its receive loop without tearing the connection down. The pending
>>> DNS lookup (which lwIP cannot cancel) later resolves, the connection is
>>> established, and httpc_recv_cb() runs against a stack frame that no longer
>>> exists. It writes attacker-controlled TCP data through store_block() to
>>> map_sysmem(ctx->daddr), with ctx read from reused stack.
>>>
>>> The httpc_connection_t passed to httpc_get_file_dns() has the same lifetime
>>> problem. lwIP stores a pointer to it in httpc_state_t.conn_settings rather
>>> than a copy, and dereferences that pointer later for the result and
>>> headers-done callbacks, so an abandoned request reads its result_fn and
>>> headers_done_fn from a stack frame that is gone.
>>>
>>> Allocate the context on the heap, move the connection settings into it
>>> (along with the TLS allocator the settings point at, so nothing lwIP
>>> retains points back at the stack), and add an 'abandoned' flag. On Ctrl-C
>>> with a request still in flight, mark it abandoned and hand ownership to the
>>> lwIP callback, which frees the context when the connection finally tears
>>> down; the receive, headers-done and result callbacks return early so a
>>> stale callback neither stores data nor touches wget_info.
>> The problem I see is that this relies on a later callback to reclaim the
>> heap context, but that callback is not guaranteed to run, especially once
>> the command removes the netif and stops the device. That fixes the UAF by
>> extending the lifetime, but can turn Ctrl-C into a leak.
>>
>> I suggest cancelling the in-flight lwIP operation before returning from
>> wget, while the stack objects are still valid. That likely means adding a
>> small DNS callback cancellation helper and an httpc_abort() helper, then
>> calling it on Ctrl-C and freeing the TLS config before returning.
>>
>> Thanks,
> 
> 
> Agreed, the heap can leak on Ctrl-C. I looked at cancelling, and from what I understand lwIP exposes no way to do it today, So both helpers are new lwIP API, and since lib/lwip/lwip is a vendored upstream import I'd like your call, upstream to lwIP first, or add them U-Boot-local?

Well, the former would be ideal, but upstream lwIP is a bit slow at processing
pull requests (I’m not blaming anyone here; that’s just how OSS projects work
sometimes). So I suggest applying local U-Boot patches and then upstreaming
them. If the upstream request changes, we can apply fixups later.

Thanks,
-- 
Jerome
> 
> Thanks,
> Shah
>