You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by xi...@apache.org on 2021/03/31 17:23:45 UTC
[incubator-nuttx] branch master updated (106a471 -> 59ed02c)
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git.
from 106a471 arch: z80: nxstyle fixes
new b3f7cf9 net: arp: Fix memory corruption in arp_send()
new 59ed02c net: arp: Fix a potential bug in arp_notify()
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
net/arp/arp_notify.c | 5 +++++
net/arp/arp_send.c | 2 ++
2 files changed, 7 insertions(+)
[incubator-nuttx] 02/02: net: arp: Fix a potential bug in
arp_notify()
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git
commit 59ed02c604c0444b90f69d3fef836ba8a6258074
Author: Masayuki Ishikawa <ma...@gmail.com>
AuthorDate: Wed Mar 31 06:59:17 2021 +0900
net: arp: Fix a potential bug in arp_notify()
Summary:
- In arp_wait_setup() and arp_wait_cancel(), g_arp_waiters
is protected by a critical section.
- However, I noticed that arp_notify() does not protect the
g_arp_waiters that would cause memory corruption
- This commit fixes the issue.
Impact:
- None
Testing:
- Tested with spresense:rndis_smp, spresense:rndis
Signed-off-by: Masayuki Ishikawa <Ma...@jp.sony.com>
---
net/arp/arp_notify.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/arp/arp_notify.c b/net/arp/arp_notify.c
index c16cbfa..562b33e 100644
--- a/net/arp/arp_notify.c
+++ b/net/arp/arp_notify.c
@@ -188,6 +188,9 @@ int arp_wait(FAR struct arp_notify_s *notify, unsigned int timeout)
void arp_notify(in_addr_t ipaddr)
{
FAR struct arp_notify_s *curr;
+ irqstate_t flags;
+
+ flags = enter_critical_section();
/* Find an entry with the matching IP address in the list of waiters */
@@ -207,6 +210,8 @@ void arp_notify(in_addr_t ipaddr)
break;
}
}
+
+ leave_critical_section(flags);
}
#endif /* CONFIG_NET_ARP_SEND */
[incubator-nuttx] 01/02: net: arp: Fix memory corruption in
arp_send()
Posted by xi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-nuttx.git
commit b3f7cf9ad901bb43a95a7233d1c8135e7deea8f5
Author: Masayuki Ishikawa <ma...@gmail.com>
AuthorDate: Wed Mar 31 06:33:37 2021 +0900
net: arp: Fix memory corruption in arp_send()
Summary:
- In arp_send(), arp_wait_setup() adds a notify object to g_arp_waiters
which is removed in arp_wait() in normal case.
- However, in timeout and error cases, the object was not removed and
caused memory corruption.
- This commit fixes this issue.
Impact:
- None
Testing:
- Tested with spresense:rndis_smp
Signed-off-by: Masayuki Ishikawa <Ma...@jp.sony.com>
---
net/arp/arp_send.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/arp/arp_send.c b/net/arp/arp_send.c
index 65f5cf8..31d84c6 100644
--- a/net/arp/arp_send.c
+++ b/net/arp/arp_send.c
@@ -341,6 +341,7 @@ int arp_send(in_addr_t ipaddr)
CONFIG_ARP_SEND_DELAYMSEC);
if (ret == -ETIMEDOUT)
{
+ arp_wait_cancel(¬ify);
goto timeout;
}
}
@@ -354,6 +355,7 @@ int arp_send(in_addr_t ipaddr)
/* Break out on a send failure */
nerr("ERROR: Send failed: %d\n", ret);
+ arp_wait_cancel(¬ify);
break;
}