From b3f7cf9ad901bb43a95a7233d1c8135e7deea8f5 Mon Sep 17 00:00:00 2001
From: Masayuki Ishikawa <masayuki.ishikawa@gmail.com>
Date: Wed, 31 Mar 2021 06:33:37 +0900
Subject: [PATCH] net: arp: Fix memory corruption in arp_send()

Summary:
- In arp_send(), arp_wait_setup() adds a notify object to g_arp_waiters
  which is removed in arp_wait() in normal case.
- However, in timeout and error cases, the object was not removed and
  caused memory corruption.
- This commit fixes this issue.

Impact:
- None

Testing:
- Tested with spresense:rndis_smp

Signed-off-by: Masayuki Ishikawa <Masayuki.Ishikawa@jp.sony.com>
---
 net/arp/arp_send.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/arp/arp_send.c b/net/arp/arp_send.c
index 65f5cf80508..31d84c6fb4a 100644
--- a/net/arp/arp_send.c
+++ b/net/arp/arp_send.c
@@ -341,6 +341,7 @@ int arp_send(in_addr_t ipaddr)
                                               CONFIG_ARP_SEND_DELAYMSEC);
           if (ret == -ETIMEDOUT)
             {
+              arp_wait_cancel(&notify);
               goto timeout;
             }
         }
@@ -354,6 +355,7 @@ int arp_send(in_addr_t ipaddr)
           /* Break out on a send failure */
 
           nerr("ERROR: Send failed: %d\n", ret);
+          arp_wait_cancel(&notify);
           break;
         }