(nuttx) branch master updated: net/pkt: allocate send callback before queueing IOB

[xiaoxiang]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new a68a64928c0 net/pkt: allocate send callback before queueing IOB
a68a64928c0 is described below

commit a68a64928c0a09c47231e4b9314826be98c37466
Author: chao an <anchao.arc...@bytedance.com>
AuthorDate: Wed Oct 21 13:27:32 2026 +0800

    net/pkt: allocate send callback before queueing IOB
    
    pkt_sendmsg() queued the prepared IOB before allocating the send callback.
    If the callback allocation then failed, the error path still freed the IOB
    even though ownership had already moved to the connection write queue.
    
    Allocate the callback before enqueueing the IOB.  This keeps the IOB owned
    by the local error path until all resources required to notify the driver
    are available, avoiding an invalid free of a queued buffer when callback
    allocation fails.
    
    Signed-off-by: chao an <anchao.arc...@bytedance.com>
---
 net/pkt/pkt_sendmsg_buffered.c | 48 +++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/net/pkt/pkt_sendmsg_buffered.c b/net/pkt/pkt_sendmsg_buffered.c
index 40b46051dbc..b9d5ac98ad4 100644
--- a/net/pkt/pkt_sendmsg_buffered.c
+++ b/net/pkt/pkt_sendmsg_buffered.c
@@ -342,22 +342,9 @@ ssize_t pkt_sendmsg(FAR struct socket *psock, FAR const 
struct msghdr *msg,
       ethhdr->type = addr->sll_protocol;
     }
 
-  if (nonblock)
-    {
-      ret = iob_tryadd_queue(iob, &conn->write_q);
-    }
-  else
-    {
-      ret = iob_add_queue(iob, &conn->write_q);
-    }
-
-  if (ret < 0)
-    {
-      nerr("ERROR: Failed to add buffer to w_queue\n");
-      goto errout_with_iob;
-    }
-
-  /* Allocate resource to receive a callback */
+  /* Allocate resource to receive a callback before enqueueing the IOB.
+   * Once the IOB is queued, ownership has moved to conn->write_q.
+   */
 
   if (conn->sndcb == NULL)
     {
@@ -374,19 +361,32 @@ ssize_t pkt_sendmsg(FAR struct socket *psock, FAR const 
struct msghdr *msg,
       ret = -ENOMEM;
       goto errout_with_iob;
     }
+
+  if (nonblock)
+    {
+      ret = iob_tryadd_queue(iob, &conn->write_q);
+    }
   else
     {
-      /* Set up the callback in the connection */
+      ret = iob_add_queue(iob, &conn->write_q);
+    }
+
+  if (ret < 0)
+    {
+      nerr("ERROR: Failed to add buffer to w_queue\n");
+      goto errout_with_iob;
+    }
 
-      conn->sndcb->flags = PKT_POLL;
-      conn->sndcb->priv  = conn;
-      conn->sndcb->event = psock_send_eventhandler;
+  /* Set up the callback in the connection */
 
-      /* Notify the device driver that new TX data is available. */
+  conn->sndcb->flags = PKT_POLL;
+  conn->sndcb->priv  = conn;
+  conn->sndcb->event = psock_send_eventhandler;
 
-      netdev_txnotify_dev(dev, PKT_POLL);
-      conn_dev_unlock(&conn->sconn, dev);
-    }
+  /* Notify the device driver that new TX data is available. */
+
+  netdev_txnotify_dev(dev, PKT_POLL);
+  conn_dev_unlock(&conn->sconn, dev);
 
   return len;