[nuttx] branch master updated (6c73221dd4 -> 44a04733d4)

[xi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


    from 6c73221dd4 forward: limit the forwarding range of broadcast packets
     new 1aceb1d872 net/tcp: Fix clear condition in ofoseg input
     new 44a04733d4 mm/iob: Don't return NULL in iob_pack

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 mm/iob/iob_pack.c   | 8 ++------
 net/tcp/tcp_input.c | 3 ++-
 2 files changed, 4 insertions(+), 7 deletions(-)

[nuttx] 02/02: mm/iob: Don't return NULL in iob_pack

[xi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git

commit 44a04733d4edc43d3208d3b0a712578923efc18a
Author: Zhe Weng <we...@xiaomi.com>
AuthorDate: Thu Apr 20 12:05:17 2023 +0800

    mm/iob: Don't return NULL in iob_pack
    
    We don't want to get a NULL pointer after iob_pack on an IOB chain with
    several iobs with length 0, it should return one IOB with length 0.
    Otherwise each place calls iob_pack needs to check the result.
    
    Signed-off-by: Zhe Weng <we...@xiaomi.com>
---
 mm/iob/iob_pack.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/mm/iob/iob_pack.c b/mm/iob/iob_pack.c
index bc0fbb96fb..55b590311f 100644
--- a/mm/iob/iob_pack.c
+++ b/mm/iob/iob_pack.c
@@ -51,15 +51,11 @@ FAR struct iob_s *iob_pack(FAR struct iob_s *iob)
   unsigned int ncopy;
   unsigned int navail;
 
-  /* Handle special cases */
+  /* Handle special cases, preserve at least one iob. */
 
-  while (iob->io_len <= 0)
+  while (iob->io_len <= 0 && iob->io_flink != NULL)
     {
       iob = iob_free(iob);
-      if (iob == NULL)
-        {
-          return NULL;
-        }
     }
 
   /* Now remember the head of the chain (for the return value) */

[nuttx] 01/02: net/tcp: Fix clear condition in ofoseg input

[xi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git

commit 1aceb1d872f0859943e8a69be3299fffb00c84f4
Author: Zhe Weng <we...@xiaomi.com>
AuthorDate: Tue Apr 18 17:46:56 2023 +0800

    net/tcp: Fix clear condition in ofoseg input
    
    We have a case that an http server gives out-of-ordered ACKs, and NuttX client makes `ofoseg`s with length 0, trying to rebuild / put them into `ofosegs` array, which is not intended (no available data and should be skipped). This breaks later logic and finally crashed in `tcp_ofoseg_bufsize` (`ofosegs[i].data` is `NULL`, which should never happen in normal logic).
    
    Note:
    - `iob_trimhead` won't return `NULL` when it's applying on normal IOB.
      - Keep `dev->d_iob == NULL` to avoid `iob_trimhead` changed.
    - `iob_free_chain` will do nothing when applied to `NULL`.
    
    Signed-off-by: Zhe Weng <we...@xiaomi.com>
---
 net/tcp/tcp_input.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tcp/tcp_input.c b/net/tcp/tcp_input.c
index 06d21a07c3..47bbb6950f 100644
--- a/net/tcp/tcp_input.c
+++ b/net/tcp/tcp_input.c
@@ -454,10 +454,11 @@ static void tcp_input_ofosegs(FAR struct net_driver_s *dev,
   /* Trim l3/l4 header to reserve appdata */
 
   dev->d_iob = iob_trimhead(dev->d_iob, len);
-  if (dev->d_iob == NULL)
+  if (dev->d_iob == NULL || dev->d_iob->io_pktlen == 0)
     {
       /* No available data, clear device buffer */
 
+      iob_free_chain(dev->d_iob);
       goto clear;
     }