From ffbb582dde2740e83bf290bfc74548f16f557acb Mon Sep 17 00:00:00 2001
From: goldsimon <goldsimon>
Date: Tue, 9 Mar 2010 16:24:38 +0000
Subject: [PATCH] ip_output: assert for p->ref == 1 to catch TCP
 retransmissions where the netif hasn't freed the pbuf yet

---
 src/core/ipv4/ip.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/core/ipv4/ip.c b/src/core/ipv4/ip.c
index b9e3091a..f1f11e42 100644
--- a/src/core/ipv4/ip.c
+++ b/src/core/ipv4/ip.c
@@ -538,6 +538,10 @@ err_t ip_output_if_opt(struct pbuf *p, ip_addr_t *src, ip_addr_t *dest,
   struct ip_hdr *iphdr;
   static u16_t ip_id = 0;
 
+  /* pbufs passed to IP must have a ref-count of 1 as their payload pointer
+     gets altered as the packet is passed down the stack */
+  LWIP_ASSERT("p->ref == 1", p->ref == 1);
+
   snmp_inc_ipoutrequests();
 
   /* Should the IP header be generated or is it already included in p? */
@@ -651,6 +655,10 @@ ip_output(struct pbuf *p, ip_addr_t *src, ip_addr_t *dest,
 {
   struct netif *netif;
 
+  /* pbufs passed to IP must have a ref-count of 1 as their payload pointer
+     gets altered as the packet is passed down the stack */
+  LWIP_ASSERT("p->ref == 1", p->ref == 1);
+
   if ((netif = ip_route(dest)) == NULL) {
     LWIP_DEBUGF(IP_DEBUG, ("ip_output: No route to %"U16_F".%"U16_F".%"U16_F".%"U16_F"\n",
       ip4_addr1_16(dest), ip4_addr2_16(dest), ip4_addr3_16(dest), ip4_addr4_16(dest)));
@@ -687,6 +695,10 @@ ip_output_hinted(struct pbuf *p, ip_addr_t *src, ip_addr_t *dest,
   struct netif *netif;
   err_t err;
 
+  /* pbufs passed to IP must have a ref-count of 1 as their payload pointer
+     gets altered as the packet is passed down the stack */
+  LWIP_ASSERT("p->ref == 1", p->ref == 1);
+
   if ((netif = ip_route(dest)) == NULL) {
     LWIP_DEBUGF(IP_DEBUG, ("ip_output: No route to %"U16_F".%"U16_F".%"U16_F".%"U16_F"\n",
       ip4_addr1_16(dest), ip4_addr2_16(dest), ip4_addr3_16(dest), ip4_addr4_16(dest)));