This is an automated email from the ASF dual-hosted git repository.

acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git

commit afc210667d751d1be46634ace87c0ba485a1a4fd
Author: daichuan <[email protected]>
AuthorDate: Thu Mar 6 19:53:40 2025 +0800

    netdev_upperhalf.c: modify for maybe use after free with upper pointer
    
    avoid continuing to access the released memory after the netdev_register
    error occurs.
    
    Signed-off-by: daichuan <[email protected]>
---
 drivers/net/netdev_upperhalf.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/netdev_upperhalf.c b/drivers/net/netdev_upperhalf.c
index 76ec08128cf..c0ae479441e 100644
--- a/drivers/net/netdev_upperhalf.c
+++ b/drivers/net/netdev_upperhalf.c
@@ -1217,13 +1217,15 @@ int netdev_lower_register(FAR struct netdev_lowerhalf_s 
*dev,
       kmm_free(upper);
       dev->netdev.d_private = NULL;
     }
-
 #ifdef CONFIG_NETDEV_WORK_THREAD
-  for (i = 0; i < NETDEV_THREAD_COUNT; i++)
+  else
     {
-      upper->tid[i] = INVALID_PROCESS_ID;
-      nxsem_init(&upper->sem[i], 0, 0);
-      nxsem_init(&upper->sem_exit[i], 0, 0);
+      for (i = 0; i < NETDEV_THREAD_COUNT; i++)
+        {
+          upper->tid[i] = INVALID_PROCESS_ID;
+          nxsem_init(&upper->sem[i], 0, 0);
+          nxsem_init(&upper->sem_exit[i], 0, 0);
+        }
     }
 #endif
 

Reply via email to