zhhyu7 opened a new pull request, #21403:
URL: https://github.com/apache/nuttx/pull/21403
## Summary
Seven fixes to `net/rpmsg/rpmsg_sockif.c`, all in the connection-setup and
poll paths. In order:
1. `rmpsgsockst:set priority` — add `conn->priority`, expose it through
`SO_PRIORITY` get/setsockopt, and apply it with `rpmsg_set_priority()` on
both the client (`device_created`) and accepted-connection (`ns_bind`)
endpoints. `setsockopt` is restructured from a single `if` into a
`switch`.
2. `return sent data if remote has no space` — when the send buffer fills
mid-transfer, `rpmsg_socket_send_continuous()` returns the byte count
already written instead of falling through to the block/`EAGAIN` path.
3. `Fix a race condition in poll` — `poll_notify()` was called from
`rpmsg_socket_poll()` without `conn->polllock`, so a concurrent notify
from the ept callback could hand userspace an all-zero `revents`.
4. `notify after receive sock_sync msg` — move the backlog enqueue and
`recvsem` post out of `ns_bind` into the sync-message handler in
`rpmsg_socket_ept_cb()`, adding `conn->server` to reach the listener.
A non-blocking server could otherwise stall in accept.
5. `fix 'use after free' at rpmsgs_dec_ref` — replace the backlog walk in
the ept callback (which freed `conn` while a reference was still held
across the callback) with an explicit `server->pending` counter checked
under `recvlock` in `ns_bind`, decremented in `accept()`.
6. `set priority before create endpoint` — call `rpmsg_set_priority()`
before `rpmsg_create_ept()`, and reject `RPMSG_PRIO_RT` from
`SO_PRIORITY`.
7. `fix memleak, do not destroy conn when connect failed` — drop the
redundant `rpmsg_socket_destroy_ept()` in the connect error path. On a
rejected connection it drove `ept->ref` to 0 while `conn->crefs` was
still 1, so the later `close()` took `ept->ref` to -1, `release_cb()`
never fired and `rpmsg_socket_free()` never ran.
Net effect: `net/rpmsg/rpmsg_sockif.c`, +108/-52.
## Impact
Confined to `AF_RPMSG` sockets; no API change. `SO_PRIORITY` is newly
accepted on rpmsg sockets (rejecting `RPMSG_PRIO_RT`) where it previously
fell through to the generic handler. Commits 4 and 5 move when a pending
connection becomes visible to `accept()` — from `ns_bind` to the
sync-message callback — so a server relying on the old ordering sees the
connection slightly later.
## Testing
`sim:rpserver` and `sim:rpproxy` both build clean. On `sim:rpserver`:
```
server> rpsock_server stream block rpsock_test &
server: create socket SOCK_STREAM nonblock 0
server: bind cpu , name rpsock_test ...
server: listen ...
server: try accept ...
server> cu -l /dev/ttyproxy
proxy> rpsock_client stream block rpsock_test server
client: create socket SOCK_STREAM nonblock 0
client: Connecting to server,rpsock_test...
server: Connection accepted -- 4
server: try accept ...
client: Connected
client send data, cnt 0, total len 64, BUFHEAD process0008, msg0000,
name:rpsock_test
client recv data process0008, msg0000, name:rpsock_test
client recv total 64, send total 64
...
client send data, cnt 1187, total 2430976
client recv data, act len 255, total 2430976
```
Socket creation, bind, listen accept, send and recv succeed with no
assertion or crash.
The rptun handshake with `sim:rpproxy` also completes (shmem `boots`/`bootm`
both
reach `STATUS_OK`, vring sequence numbers advance).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
