(nuttx) branch releases/13.1 updated: net/pkt: clear pending TX IOB reference when poll callback finishes

[acassis]

This is an automated email from the ASF dual-hosted git repository.

acassis pushed a commit to branch releases/13.1
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/releases/13.1 by this push:
     new f73728ba195 net/pkt: clear pending TX IOB reference when poll callback 
finishes
f73728ba195 is described below

commit f73728ba195d95b9d4a9062039fb312dda68a5e3
Author: Daniel P. Carvalho <daniel...@gmail.com>
AuthorDate: Thu Sep 17 08:13:45 2026 -0300

    net/pkt: clear pending TX IOB reference when poll callback finishes
    
    pkt_poll() records the outgoing IOB in pkt_conn->pendiob so that any
    synchronous TX tap or loopback executed during the driver callback can
    skip delivering the packet back to the sending socket.
    
    Previously, pendiob was never cleared upon TX completion and would
    linger across transmissions as a dangling pointer. Because the IOB
    pool is small and recycled quickly (LIFO), a subsequent incoming
    packet from the network frequently reused the same IOB buffer address,
    causing pkt_in() to drop legitimate RX packets as false self-echoes.
    
    Drop the pendiob reference immediately after callback(dev) returns in
    devif_poll_pkt_connections(), ensuring the pointer never outlives the
    transmission cycle.
    
    Also fixes a pre-existing nxstyle alignment issue in devif_poll.c
    IPv6 version-check block (unrelated nerr() call), since this file is
    now touched and CI enforces style on the whole file.
    
    Suggested-by: zhhyu7
    Assisted-by: Gemini:gemini-3.8-flash-medium
    Signed-off-by: Daniel P. Carvalho <daniel...@gmail.com>
---
 net/devif/devif_poll.c | 14 ++++++++++++--
 net/pkt/pkt_input.c    |  6 ++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/net/devif/devif_poll.c b/net/devif/devif_poll.c
index f4e675f8918..059df2b2833 100644
--- a/net/devif/devif_poll.c
+++ b/net/devif/devif_poll.c
@@ -120,8 +120,8 @@ static void devif_packet_conversion(FAR struct net_driver_s 
*dev,
 #ifdef CONFIG_NET_IPv4
           if ((ipv6->vtc & IP_VERSION_MASK) != IPv6_VERSION)
             {
-               nerr("ERROR: IPv6 version error: %02x...  Packet dropped\n",
-                    ipv6->vtc);
+              nerr("ERROR: IPv6 version error: %02x...  Packet dropped\n",
+                   ipv6->vtc);
             }
           else
 #endif
@@ -259,6 +259,16 @@ devif_poll_pkt_connections(FAR struct net_driver_s *dev,
             {
               bstop = callback(dev);
             }
+
+          /* pkt_poll() records the outgoing IOB in pkt_conn->pendiob so that
+           * the TX tap run from the driver callback above can skip the
+           * sending connection.  Drop the reference now that the callback
+           * has returned: it must not outlive the buffer it points at, or a
+           * later frame reusing the same IOB address would be withheld from
+           * this connection.
+           */
+
+          pkt_conn->pendiob = NULL;
         }
     }
 
diff --git a/net/pkt/pkt_input.c b/net/pkt/pkt_input.c
index 5840d246a70..93701b5750d 100644
--- a/net/pkt/pkt_input.c
+++ b/net/pkt/pkt_input.c
@@ -164,9 +164,11 @@ static int pkt_in(FAR struct net_driver_s *dev)
 
       if (conn->pendiob == dev->d_iob)
         {
-          /* Do not read back the packet sent by oneself */
+          /* Do not read back the packet sent by oneself.  pendiob is
+           * released by devif_poll_pkt_connections() once this tap run
+           * completes, so it is always a live reference here.
+           */
 
-          conn->pendiob = NULL;
           pkt_conn_list_unlock();
           return OK;
         }