jerpelea opened a new pull request, #21300: URL: https://github.com/apache/nuttx/pull/21300
## Summary In tcp_timer_expiry(), conn->dev was accessed without a NULL check, leading to a crash (Load Access Fault on offsetof(struct net_driver_s, d_lock)) if conn->dev was unbound or zeroed out during connection teardown. Furthermore, tcp_stop_timer() used asynchronous work_cancel(), which does not wait for a worker callback that is already running. If tcp_timer_expiry() was dequeued on LPWORK while tcp_free() was called on another thread, tcp_free() would clear the connection structure via net_bufpool_free() (zeroing out conn->dev and other fields), causing a race and crash in tcp_timer_expiry(). This commit: 1. Replaces work_cancel() with work_cancel_sync() in tcp_stop_timer(), ensuring any running timer expiry callback finishes before the connection is deallocated. 2. Captures conn->dev under the active connection list lock and guards netdev_lock()/netdev_txnotify_dev() with a NULL check. Fixes: #19849 ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
