(nuttx) branch master updated: drivers/can/ctucanfd_pci.c: fix SocketCAN RX build and packet leak.

[acassis]

This is an automated email from the ASF dual-hosted git repository.

acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 70d7f893839 drivers/can/ctucanfd_pci.c: fix SocketCAN RX build and 
packet leak.
70d7f893839 is described below

commit 70d7f8938391ae329169c077081f260766dd22a3
Author: raiden00pl <raide...@railab.me>
AuthorDate: Wed Oct 7 10:23:18 2026 +0200

    drivers/can/ctucanfd_pci.c: fix SocketCAN RX build and packet leak.
    
    ctucanfd_sock_recv() did not compile with CONFIG_CAN_CTUCANFD_SOCKET:
    * the rwcnt bounds check used an undeclared 'frame' instead of
      'rxframe';
    * the !CONFIG_NET_CAN_EXTID paths used 'continue' outside a loop.
    Both error paths now free the allocated RX packet and return NULL,
    so a dropped frame no longer leaks the netpkt. Also add the blank
    lines after declarations that nxstyle requires in this file.
    
    Assisted-by: Claude:claude-opus-5-5
    Signed-off-by: raiden00pl <raide...@railab.me>
---
 drivers/can/ctucanfd_pci.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/can/ctucanfd_pci.c b/drivers/can/ctucanfd_pci.c
index d8287b8fbd8..d2c21f8824e 100644
--- a/drivers/can/ctucanfd_pci.c
+++ b/drivers/can/ctucanfd_pci.c
@@ -263,6 +263,7 @@ static uint32_t ctucanfd_getreg(FAR struct ctucanfd_can_s 
*priv,
                                 unsigned int offset)
 {
   uintptr_t addr = priv->base + offset;
+
   return *((FAR volatile uint32_t *)addr);
 }
 
@@ -275,6 +276,7 @@ static void ctucanfd_putreg(FAR struct ctucanfd_can_s *priv,
                             uint32_t value)
 {
   uintptr_t addr = priv->base + offset;
+
   *((FAR volatile uint32_t *)addr) = value;
 }
 
@@ -1259,9 +1261,10 @@ static FAR netpkt_t *ctucanfd_sock_recv(FAR struct 
netdev_lowerhalf_s *dev)
 
   /* buff[0] populated the frame->fmt.rwcnt. Check before use. */
 
-  if (frame->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]) - 1)
+  if (rxframe->fmt.rwcnt > sizeof(buff) / sizeof(buff[0]) - 1)
     {
       canerr("ERROR: CAN read/write count is too large.  Dropped\n");
+      netpkt_free(dev, pkt, NETPKT_RX);
       return NULL;
     }
 
@@ -1303,7 +1306,8 @@ static FAR netpkt_t *ctucanfd_sock_recv(FAR struct 
netdev_lowerhalf_s *dev)
         {
           canerr("ERROR: Received message with extended"
                  " identifier.  Dropped\n");
-          continue;
+          netpkt_free(dev, pkt, NETPKT_RX);
+          return NULL;
         }
 
       frame->can_id = rxframe->id.id;
@@ -1367,7 +1371,8 @@ static FAR netpkt_t *ctucanfd_sock_recv(FAR struct 
netdev_lowerhalf_s *dev)
         {
           canerr("ERROR: Received message with extended"
                  " identifier.  Dropped\n");
-          continue;
+          netpkt_free(dev, pkt, NETPKT_RX);
+          return NULL;
         }
 
       frame->can_id = rxframe->id.id;