dev

Oopenvela-robotnet/rpmsg_sockif: fix memleak, do not destroy conn when connect failed

550c5513创建于 4月21日历史提交

文件	最后提交记录	最后更新时间
CMakeLists.txt	net: migrate to SPDX identifier Most tools used for compliance and SBOM generation use SPDX identifiers This change brings us a step closer to an easy SBOM generation. Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>	2 个月前
Kconfig	Merge branch 'master' into vela apache/nuttx commit id: eb27ebba8adfe29644a7b890f86e6f16941921dc Signed-off-by: ligd <liguiding1@xiaomi.com> Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>	2 个月前
Make.defs	net: migrate to SPDX identifier Most tools used for compliance and SBOM generation use SPDX identifiers This change brings us a step closer to an easy SBOM generation. Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>	2 个月前
rpmsg.h	net: migrate to SPDX identifier Most tools used for compliance and SBOM generation use SPDX identifiers This change brings us a step closer to an easy SBOM generation. Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>	2 个月前
rpmsg_sockif.c	net/rpmsg_sockif: fix memleak, do not destroy conn when connect failed When server rejects a connection (pending >= backlog), it sends NS_DESTROY to client. The client then calls rpmsg_socket_destroy_ept() which decrements ept->ref to 0 and triggers rpmsg_socket_ept_release(). However, conn->crefs is still 1 at this point, so the connection is not freed. Later when user calls close(), conn->crefs becomes 0 and rpmsg_socket_destroy_ept() is called again, but ept->ref becomes -1, which prevents ept->release_cb() from being called. As a result, rpmsg_socket_free() is never invoked and memory leaks. Fix this by removing the redundant rpmsg_socket_destroy_ept() call in the connect error path. The endpoint cleanup should be handled by the close() path through normal reference counting. Memleak diagram: Client Server connect() ---> rpmsg_socket_ns_bind() | reject (pending >= backlog) |-unbind <--- NS_DESTROY |-rpmsg_socket_destroy_ept() |-rpmsg_socket_ept_release() ept->ref = 0 |-but conn->crefs = 1, not free conn |-return -ECONNRESET to user close() |-conn->crefs ==> 0 |-rpmsg_socket_destroy_ept() ept->ref = -1 |-not call ept->realease_cb() and rpmsg_socket_free() |-will never be called and memory leak occur. Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com>	2 个月前