Skip to content

Commit 1231317

Browse files
authored
Fix race condition between WiFi receive and consume (#1614)
If another packet comes in between freeing `_rx_buf` and setting `_rx_buf` to 0, that new packet could get put into the same memory address and get concatenated to itself, which leads to an infinite loop. New solution assigns a temp pointer, sets `rx_buf` to 0, then frees the memory, which guarantees `_rx_buf` always points to valid data.
1 parent cd76f03 commit 1231317

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

libraries/WiFi/src/include/ClientContext.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -611,9 +611,10 @@ class ClientContext {
611611
_rx_buf_offset += size;
612612
} else if (!_rx_buf->next) {
613613
DEBUGV(":c0 %d, %d\r\n", size, _rx_buf->tot_len);
614-
pbuf_free(_rx_buf);
614+
auto head = _rx_buf;
615615
_rx_buf = 0;
616616
_rx_buf_offset = 0;
617+
pbuf_free(head);
617618
} else {
618619
DEBUGV(":c %d, %d, %d\r\n", size, _rx_buf->len, _rx_buf->tot_len);
619620
auto head = _rx_buf;

0 commit comments

Comments
 (0)