[TCP Slave] Crash reset when the number of access connections exceeds CONFIG_FMB_TCP_PORT_MAX_CONN (IDFGH-15541)

[dsyx]

Checklist

• Checked the issue tracker for similar issues to ensure this is not a duplicate
• Read the documentation to confirm the issue is not addressed there and your configuration is set correctly
• Tested with the latest version to ensure the issue hasn't been fixed

How often does this bug occurs?

always

Expected behavior

TCP Slave should only keep CONFIG_FMB_TCP_PORT_MAX_CONN connections and should refuse connections when the number of connections is full.

Actual behavior (suspected bug)

Build a TCP Slave using the v2.1.0 release with CONFIG_FMB_TCP_PORT_MAX_CONN=2. When a new connection request comes after 2 connections already exist, the TCP Slave will accept it and then crash:

[11:27:25.817]收←◆I (5537) port.utils: mdns delegate hostname set to: [mb_slave_tcp_01]
I (5537) port.utils: IP: 10.10.49.115
I (5537) port.utils: GW: 10.10.0.1
I (5547) port.utils: NETMASK: 255.255.0.0
I (5547) port.utils: Socket (#54), listener  on port: 502, errno=0
I (5547) mb_port.tcp.slave: loop:0x40844e94  mbs_on_ready: fd: -1, bind is done

[11:28:28.896]收←◆I (68607) port.utils: Socket (#55), accept client connection from address[port]: 10.10.10.10[64500]

[11:28:58.858]收←◆I (98577) port.utils: Socket (#56), accept client connection from address[port]: 10.10.10.10[64520]

[11:29:11.159]收←◆I (110877) port.utils: Socket (#57), accept client connection from address[port]: 10.10.10.10[64521]
E (110877) mb_driver: 0x40844e94, unable to open node: 10.10.10.10
Guru Meditation Error: Core  0 panic'ed (Cache error). 
Cache access error

Core  0 register dump:
MEPC    : 0x4205b4ce  RA      : 0x42059974  SP      : 0x408463b0  GP      : 0x40822094  
TP      : 0x408464d0  T0      : 0x40022494  T1      : 0xffffffe0  T2      : 0xffffffff  
S0/FP   : 0x40844e94  S1      : 0x4082f4bc  A0      : 0x40844e94  A1      : 0x4082f4c0  
A2      : 0x00000032  A3      : 0x4082f4bc  A4      : 0x408466f0  A5      : 0x428f7e58  
A6      : 0x4205994e  A7      : 0x42079d3a  S2      : 0x00000000  S3      : 0x00002b21  
S4      : 0x00000005  S5      : 0x00000000  S6      : 0x00000005  S7      : 0x00000000  
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000  
T3      : 0x00000000  T4      : 0x00000000  T5      : 0x00000000  T6      : 0x00000000  
MSTATUS : 0x00001881  MTVEC   : 0x40800001  MCAUSE  : 0x00000019  MTVAL   : 0x00001141  
MHARTID : 0x00000000  

Stack memory:
408463b0: 0x00000000 0x408450fc 0x00000000 0x420fd4b4 0x00000000 0x408450fc 0x00000000 0x420fde00
408463d0: 0x00000101 0x40845448 0x00000040 0x4082f4bc 0x00000101 0x40845448 0x00000040 0x4082f4bc
408463f0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40846410: 0x00000000 0x40844e94 0x00000000 0x4205b29e 0x00000080 0x00000039 0x4083a98c 0x4083a98c
40846430: 0x00000001 0xfc090000 0x00000002 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40846450: 0x00000002 0x00000001 0x00000040 0x01800000 0x00000000 0x00000000 0x00000080 0x4082d494
40846470: 0x4083a98c 0x4083a98c 0x00000001 0xfc090000 0x00000002 0x00000000 0x00000000 0x00000000
40846490: 0x00000000 0x00000000 0x00000000 0x40810442 0x00000000 0x00000000 0x00000000 0x00000000
408464b0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
408464d0: 0xa5a5a5a5 0x00000150 0x40846220 0x00002b20 0x40825e4c 0x40825e4c 0x408464d8 0x40825e44
408464f0: 0x0000000f 0x40832580 0x40832580 0x408464d8 0x00000000 0x0000000a 0x408454d4 0x645f626d
40846510: 0x745f7672 0x745f7063 0x006b7361 0x408464d0 0x0000000a 0x00000001 0x40846f04 0x42008852
40846530: 0x00000080 0x4082dda8 0x4082de10 0x4082de78 0x00000000 0x00000000 0x00000001 0x00000000
40846550: 0x00000000 0x00000000 0x4200820e 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40846570: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40846590: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
408465b0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
408465d0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
408465f0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
40846610: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000010 0x40845448
40846630: 0x00000000 0x40846640 0x00000000 0x0000000c 0x00000001 0x40846650 0x40846670 0x0000000c
40846650: 0x40846660 0x00000000 0x00000000 0x0000000c 0x42059356 0x40844e94 0x40846658 0x0000000c
40846670: 0x00000002 0x40846680 0x408466a0 0x0000000c 0x40846690 0x00000000 0x00000000 0x0000000c
40846690: 0x42058d96 0x40844e94 0x40846688 0x0000000c 0x00000008 0x408466b0 0x408466d0 0x0000000c
408466b0: 0x408466c0 0x00000000 0x00000000 0x0000000c 0x420594bc 0x40844e94 0x408466b8 0x0000000c
408466d0: 0x00000040 0x408466e0 0x40846700 0x0000000c 0x408466f0 0x00000000 0x00000000 0x0000000c
408466f0: 0x4205994e 0x40844e94 0x408466e8 0x0000000c 0x00000010 0x40846710 0x40846730 0x0000000c
40846710: 0x40846720 0x00000000 0x00000000 0x0000000c 0x42059704 0x40844e94 0x40846718 0x0000000c
40846730: 0x00000020 0x40846740 0x40846760 0x0000000c 0x40846750 0x00000000 0x00000000 0x0000000c
40846750: 0x4205955a 0x40844e94 0x40846748 0x0000000c 0x00000080 0x40846770 0x40846790 0x0000000c
40846770: 0x40846780 0x00000000 0x00000000 0x0000000c 0x420599e4 0x40844e94 0x40846778 0x0000000c
40846790: 0x00000100 0x408467a0 0x00000000 0x0000000c 0x408467b0 0x00000000 0x00000000 0x0000000c



ELF file SHA256: de96cf623

Rebooting...

And there is a chance to trigger the following infinite loop reset:

E (90192) task_wdt: Task watchdog got triggered. The following tasks/users did not reset the watchdog in time:
E (90192) task_wdt:  - IDLE (CPU 0)
E (90192) task_wdt: Tasks currently running:
E (90192) task_wdt: CPU 0: mb_drv_tcp_task
E (90192) task_wdt: Print CPU 0 (current core) backtrace
esp_backtrace_print: Print CPU 0 (current core) registers
Core  0 register dump:
MEPC    : 0x4205a2b2  RA      : 0x4205a4a4  SP      : 0x408463f0  GP      : 0x40822094  
TP      : 0x408464e0  T0      : 0x40022494  T1      : 0xffffffe0  T2      : 0xffffffff  
S0/FP   : 0x40846468  S1      : 0x40846470  A0      : 0x40844eec  A1      : 0x40846418  
A2      : 0x40846470  A3      : 0x40846418  A4      : 0x40844eec  A5      : 0x00000000  
A6      : 0x00000001  A7      : 0x00000001  S2      : 0x00000000  S3      : 0x00000000  
S4      : 0x00000000  S5      : 0x00000000  S6      : 0x00000000  S7      : 0x00000000  
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000  
T3      : 0x00000000  T4      : 0x00000000  T5      : 0x0ccccccc  T6      : 0x00000019  
MSTATUS : 0x00001889  MTVEC   : 0x40800001  MCAUSE  : 0xdeadc0de  MTVAL   : 0xdeadc0de  
MHARTID : 0x00000000

The Modbus configuration of sdkconfig during build is as follows:

#
# Modbus configuration
#
CONFIG_FMB_COMM_MODE_TCP_EN=y
CONFIG_FMB_TCP_PORT_DEFAULT=502
CONFIG_FMB_TCP_PORT_MAX_CONN=2
CONFIG_FMB_TCP_CONNECTION_TOUT_SEC=20
# CONFIG_FMB_TCP_UID_ENABLED is not set
# CONFIG_FMB_COMM_MODE_RTU_EN is not set
# CONFIG_FMB_COMM_MODE_ASCII_EN is not set
CONFIG_FMB_MASTER_TIMEOUT_MS_RESPOND=10000
CONFIG_FMB_MASTER_DELAY_MS_CONVERT=200
CONFIG_FMB_QUEUE_LENGTH=20
CONFIG_FMB_PORT_TASK_STACK_SIZE=4096
CONFIG_FMB_BUFFER_SIZE=260
CONFIG_FMB_PORT_TASK_PRIO=10
CONFIG_FMB_PORT_TASK_AFFINITY=0x7FFFFFFF
CONFIG_FMB_CONTROLLER_SLAVE_ID_SUPPORT=y
CONFIG_FMB_CONTROLLER_SLAVE_ID=0x00112233
CONFIG_FMB_CONTROLLER_SLAVE_ID_MAX_SIZE=32
CONFIG_FMB_CONTROLLER_NOTIFY_TIMEOUT=20
CONFIG_FMB_CONTROLLER_NOTIFY_QUEUE_SIZE=20
CONFIG_FMB_CONTROLLER_STACK_SIZE=4096
CONFIG_FMB_EVENT_QUEUE_TIMEOUT=20
# CONFIG_FMB_TIMER_USE_ISR_DISPATCH_METHOD is not set
# CONFIG_FMB_EXT_TYPE_SUPPORT is not set
CONFIG_FMB_FUNC_HANDLERS_MAX=16
# end of Modbus configuration

Error logs or terminal output

Steps to reproduce the behavior

1. Use the TCP client tool to establish CONFIG_FMB_TCP_PORT_MAX_CONN connections to the TCP Slave.
2. Continue to use the TCP client tool to establish a new connection to the TCP Slave.

Project release version

v2.1.0

System architecture

Intel/AMD 64-bit (modern PC, older Mac)

Operating system

Windows

Operating system version

Windows 10 22H2

Shell

Bash

Additional context

No response

[alisitsyn]

@dsyx,

Thank you for reporting. I am going to set limit for listen backlog to limit possible client connections or will handle the accept() accordingly to avoid select errors in the task. Will let you know once fixed.

[alisitsyn]

@dsyx ,

Just to let you know the possible solution for this: is to close the accepted socket if the number of connections exceeded the maximum.

port_tcp_driver.c:632:

void mb_drv_tcp_task(void *ctx):
..............
            } else if (pdrv_ctx->listen_sock_fd && FD_ISSET(pdrv_ctx->listen_sock_fd, &readset)) {
                // If something happened on the listen socket, then it is an incoming connection.
                ESP_LOGD(TAG, "%p, listen_sock is active.", ctx);
                    mb_uid_info_t node_info = {0};
                    int sock_id = port_accept_connection(pdrv_ctx->listen_sock_fd, &node_info);
                    if (sock_id) {
                        if (pdrv_ctx->mb_node_open_count >= MB_MAX_FDS) {
                            ESP_LOGE(TAG, "%p, unable to accept node, maximum is %u connections.", pdrv_ctx, MB_MAX_FDS);
                            // struct linger lo = { 1, 0 };
                            // setsockopt(sock_id, SOL_SOCKET, SO_LINGER, &lo, sizeof(lo)); // send RST
                            close(sock_id);
                        } else {
                            int fd = mb_drv_open(pdrv_ctx, node_info, 0);
                            if (fd < 0) {
                                ESP_LOGE(TAG, "%p, unable to open node: %s, %d", pdrv_ctx, node_info.ip_addr_str, fd);
                            } else {
                                DRIVER_SEND_EVENT(ctx, MB_EVENT_CONNECT, fd);
                            }
                        }
                    }
                
            } else {
..............

[dsyx]

Hi @alisitsyn ,

I have now temporarily avoided this problem by configuring the following:

CONFIG_FMB_TCP_PORT_MAX_CONN=10
CONFIG_FMB_TCP_CONNECTION_TOUT_SEC=3

Please notify me when you release a fixed version later, thank you.

[alisitsyn]

Fix has been merged into main with commit: [7b2dd25]