net/arp: Fix a potential bug in arp_notify()

Summary:
- In arp_wait_setup() and arp_wait_cancel(), g_arp_waiters
  is protected by a critical section.
- However, I noticed that arp_notify() does not protect the
  g_arp_waiters that would cause memory corruption
- This commit fixes the issue.

Impact:
- None

Testing:
- Tested with spresense:rndis_smp, spresense:rndis

Change-Id: I3e13d556dea0934f1d0edd6451ad2e51a86dfeed
Signed-off-by: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
This commit is contained in:
Jiuzhu Dong
2021-04-13 17:01:44 +08:00
parent 8327f4b825
commit 903d472f78
+4
View File
@@ -188,9 +188,11 @@ int arp_wait(FAR struct arp_notify_s *notify, unsigned int timeout)
void arp_notify(in_addr_t ipaddr)
{
FAR struct arp_notify_s *curr;
irqstate_t flags;
/* Find an entry with the matching IP address in the list of waiters */
flags = enter_critical_section();
for (curr = g_arp_waiters; curr; curr = curr->nt_flink)
{
/* Does this entry match? If the result is okay, then we have
@@ -207,6 +209,8 @@ void arp_notify(in_addr_t ipaddr)
break;
}
}
leave_critical_section(flags);
}
#endif /* CONFIG_NET_ARP_SEND */