Crash in tcpip_thread when using esp_vfs_select() on both socket and UART simultaneously (IDFGH-7308) #8896
Description
Environment
- Development Kit: none (board: WT32-ETH01)
- Module or chip used: WT32-S1 (ESP32-D0WD)
- IDF version:
v5.0-dev-2586-ga82e6e63d9 - Build System: idf.py
- Compiler version:
xtensa-esp32-elf-gcc (crosstool-NG esp-2021r2-patch3) 8.4.0 - Operating System: Linux
- Using an IDE?: No
- Power Supply: USB
Problem Description
I am using select() (most probably esp_vfs_select()) to wait for data on TCP socket and UART simultaneously. The application sometimes crashes in tcpip_thread when there is incoming traffic on both file descriptors. The problem disappears when the task is pinned to the same core as the tcpdip_thread. I believe that pining should not be necessary, as it is quite limiting.
I also tried to enable config option CONFIG_LWIP_TCPIP_CORE_LOCKING=y. But this disables select()'s ability to be interrupted on UART data.
Expected Behavior
No crashes on select() should happen. Especially when it is explicitly allowed by documentation of option:
https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/kconfig.html#config-vfs-support-select
Actual Behavior
System crashes inside tcpip_thread
Guru Meditation Error: Core 0 panic'ed (LoadProhibited). Exception was unhandled.
Core 0 register dump:
PC : 0x400f7fd8 PS : 0x00060b30 A0 : 0x800e4efc A1 : 0x3ffb90f0
0x400f7fd8: lwip_netconn_do_write at /home/had/esp-idf/components/lwip/lwip/src/api/api_msg.c:1920
Steps to reproduce
- navigate to
tcp_serverexample provided withesp-idf(esp-idf/examples/protocols/sockets/tcp_server) - replace
tcp_server.cwith slightly modified version from: https://gist.github.com/hadrava/55d5612d44f98df76a41a8a9158ab502#file-tcp_server-c - adjust UART pin assignments (on line 208) for particular board
- configure ethernet, disable WiFi and IPv6. (or use linked
sdkconfig.defaultsfor WT32-ETH01 board) - connect to tcp server and send some data to it (for example
yes | nc 10.11.13.10 3333) - send few bytes to UART2
Code to reproduce this issue
Simplified version - this also crashes, even without send(sock):
fd_set rfds;
FD_ZERO(&rfds);
FD_SET(sock, &rfds);
FD_SET(uart_fd, &rfds);
struct timeval timeout_tv = {
.tv_sec = 5,
.tv_usec = 0,
};
int max_fd = (sock > uart_fd) ? sock : uart_fd;
int ret = select(max_fd + 1, &rfds, NULL, NULL, &timeout_tv);
if (ret > 0 && FD_ISSET(sock, &rfds)) {
len = recv(sock, rx_buffer, sizeof(rx_buffer) - 1, 0);
}
if (ret > 0 && FD_ISSET(uart_fd, &rfds)) {
len = read(uart_fd, rx_buffer, 1);
}
https://gist.github.com/hadrava/55d5612d44f98df76a41a8a9158ab502#file-tcp_server-c
Debug Logs
Guru Meditation Error: Core 0 panic'ed (LoadProhibited). Exception was unhandled.
Core 0 register dump:
PC : 0x400f7fd8 PS : 0x00060b30 A0 : 0x800e4efc A1 : 0x3ffb90f0
0x400f7fd8: lwip_netconn_do_write at /home/had/esp-idf/components/lwip/lwip/src/api/api_msg.c:1920
A2 : 0x3ffbf850 A3 : 0x3ffb9130 A4 : 0x00000000 A5 : 0x000005d6
A6 : 0x3f409650 A7 : 0x400e4f68 A8 : 0x800f7fd0 A9 : 0x00000000
0x400e4f68: tcpip_thread at /home/had/esp-idf/components/lwip/lwip/src/api/tcpip.c:134
A10 : 0x00000000 A11 : 0x00000000 A12 : 0x3ffb8358 A13 : 0x00000001
A14 : 0x00000001 A15 : 0x00000000 SAR : 0x0000000a EXCCAUSE: 0x0000001c
EXCVADDR: 0x00000000 LBEG : 0x4000c2e0 LEND : 0x4000c2f6 LCOUNT : 0xffffffff
Backtrace:0x400f7fd5:0x3ffb90f00x400e4ef9:0x3ffb9110 0x400e4f98:0x3ffb9130 0x40089cc1:0x3ffb9160
0x400f7fd5: lwip_netconn_do_write at /home/had/esp-idf/components/lwip/lwip/src/api/api_msg.c:1919
0x400e4ef9: tcpip_thread_handle_msg at /home/had/esp-idf/components/lwip/lwip/src/api/tcpip.c:168
0x400e4f98: tcpip_thread at /home/had/esp-idf/components/lwip/lwip/src/api/tcpip.c:154
0x40089cc1: vPortTaskWrapper at /home/had/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:141
https://gist.github.com/hadrava/55d5612d44f98df76a41a8a9158ab502#file-full-console-log-txt