From 59ed02c604c0444b90f69d3fef836ba8a6258074 Mon Sep 17 00:00:00 2001 From: Masayuki Ishikawa Date: Wed, 31 Mar 2021 06:59:17 +0900 Subject: [PATCH] net: arp: Fix a potential bug in arp_notify() Summary: - In arp_wait_setup() and arp_wait_cancel(), g_arp_waiters is protected by a critical section. - However, I noticed that arp_notify() does not protect the g_arp_waiters that would cause memory corruption - This commit fixes the issue. Impact: - None Testing: - Tested with spresense:rndis_smp, spresense:rndis Signed-off-by: Masayuki Ishikawa --- net/arp/arp_notify.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/arp/arp_notify.c b/net/arp/arp_notify.c index c16cbfa7db..562b33ee80 100644 --- a/net/arp/arp_notify.c +++ b/net/arp/arp_notify.c @@ -188,6 +188,9 @@ int arp_wait(FAR struct arp_notify_s *notify, unsigned int timeout) void arp_notify(in_addr_t ipaddr) { FAR struct arp_notify_s *curr; + irqstate_t flags; + + flags = enter_critical_section(); /* Find an entry with the matching IP address in the list of waiters */ @@ -207,6 +210,8 @@ void arp_notify(in_addr_t ipaddr) break; } } + + leave_critical_section(flags); } #endif /* CONFIG_NET_ARP_SEND */