From 903d472f78cbd9cfcc0152aed400061d502d1324 Mon Sep 17 00:00:00 2001 From: Jiuzhu Dong Date: Tue, 13 Apr 2021 17:01:44 +0800 Subject: [PATCH] net/arp: Fix a potential bug in arp_notify() Summary: - In arp_wait_setup() and arp_wait_cancel(), g_arp_waiters is protected by a critical section. - However, I noticed that arp_notify() does not protect the g_arp_waiters that would cause memory corruption - This commit fixes the issue. Impact: - None Testing: - Tested with spresense:rndis_smp, spresense:rndis Change-Id: I3e13d556dea0934f1d0edd6451ad2e51a86dfeed Signed-off-by: Jiuzhu Dong --- net/arp/arp_notify.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/arp/arp_notify.c b/net/arp/arp_notify.c index c16cbfa7dbb..77205cb72ad 100644 --- a/net/arp/arp_notify.c +++ b/net/arp/arp_notify.c @@ -188,9 +188,11 @@ int arp_wait(FAR struct arp_notify_s *notify, unsigned int timeout) void arp_notify(in_addr_t ipaddr) { FAR struct arp_notify_s *curr; + irqstate_t flags; /* Find an entry with the matching IP address in the list of waiters */ + flags = enter_critical_section(); for (curr = g_arp_waiters; curr; curr = curr->nt_flink) { /* Does this entry match? If the result is okay, then we have @@ -207,6 +209,8 @@ void arp_notify(in_addr_t ipaddr) break; } } + + leave_critical_section(flags); } #endif /* CONFIG_NET_ARP_SEND */