This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 082abbcf5b35ae4506ea0af3a31dfc21e1f46f9c Author: Bowen Wang <[email protected]> AuthorDate: Thu Jan 22 11:34:05 2026 +0800 net/rpmsg_sockif: fix memleak, do not destroy conn when connect failed When server rejects a connection (pending >= backlog), it sends NS_DESTROY to client. The client then calls rpmsg_socket_destroy_ept() which decrements ept->ref to 0 and triggers rpmsg_socket_ept_release(). However, conn->crefs is still 1 at this point, so the connection is not freed. Later when user calls close(), conn->crefs becomes 0 and rpmsg_socket_destroy_ept() is called again, but ept->ref becomes -1, which prevents ept->release_cb() from being called. As a result, rpmsg_socket_free() is never invoked and memory leaks. Fix this by removing the redundant rpmsg_socket_destroy_ept() call in the connect error path. The endpoint cleanup should be handled by the close() path through normal reference counting. Memleak diagram: Client Server connect() ---> rpmsg_socket_ns_bind() | reject (pending >= backlog) |-unbind <--- NS_DESTROY |-rpmsg_socket_destroy_ept() |-rpmsg_socket_ept_release() ept->ref = 0 |-but conn->crefs = 1, not free conn |-return -ECONNRESET to user close() |-conn->crefs ==> 0 |-rpmsg_socket_destroy_ept() ept->ref = -1 |-not call ept->realease_cb() and rpmsg_socket_free() |-will never be called and memory leak occur. Signed-off-by: Bowen Wang <[email protected]> --- net/rpmsg/rpmsg_sockif.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/net/rpmsg/rpmsg_sockif.c b/net/rpmsg/rpmsg_sockif.c index c415abe131d..f6a5b5a3af2 100644 --- a/net/rpmsg/rpmsg_sockif.c +++ b/net/rpmsg/rpmsg_sockif.c @@ -976,16 +976,6 @@ static int rpmsg_socket_connect_internal(FAR struct socket *psock) { ret = -ECONNRESET; } - - if (ret < 0) - { - rpmsg_unregister_callback(conn, - rpmsg_socket_device_created, - NULL, - NULL, - NULL); - rpmsg_socket_destroy_ept(conn); - } } else {
