Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/sec-1129-l2tap-close-rollback_v5.5' into 'release/v5.5'

Browse Source 
fix(esp_netif): roll back l2tap_close on semaphore/task create failure (SEC-1129) (v5.5)

See merge request espressif/esp-idf!51399
This commit is contained in:
Euripedes Rocha
2026-07-31 14:38:43 +02:00
parent 3844dee2e7 0dc7c2f853
commit 065069270b
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
components/esp_netif/vfs_l2tap/esp_vfs_l2tap.c
View File

@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -478,14 +478,16 @@ static int l2tap_close(int fd)
if ((s_l2tap_sockets[fd].close_done_sem = xSemaphoreCreateBinary()) == NULL) {
ESP_LOGE(TAG, "create close_done_sem failed");
return -1;
goto close_failed;
}
// If one task is blocked in I/O operation and another task tries to close the fd, the first task is
// unblocked by pushing empty queue in low priority task (to ensure context switch to the first task).
// The first's task read operation then ends with error and the low priority task frees the queue resources.
if (xTaskCreate(l2tap_clean_task, "l2tap_clean_task", 1024, &s_l2tap_sockets[fd], tskIDLE_PRIORITY, NULL) == pdFAIL) {
ESP_LOGE(TAG, "create l2tap_clean_task failed");
return -1;
vSemaphoreDelete(s_l2tap_sockets[fd].close_done_sem);
s_l2tap_sockets[fd].close_done_sem = NULL;
goto close_failed;
}
// wait for the low priority close task & then delete the semaphore
@@ -495,6 +497,14 @@ static int l2tap_close(int fd)
// indicate that socket is ready to be used again
atomic_store(&s_l2tap_sockets[fd].state, L2TAP_SOCK_STATE_READY);
return 0;
close_failed:
flush_rx_queue(&s_l2tap_sockets[fd]);
(void)push_rx_queue(&s_l2tap_sockets[fd], NULL, 0, NULL);
delete_rx_queue(&s_l2tap_sockets[fd]);
atomic_store(&s_l2tap_sockets[fd].state, L2TAP_SOCK_STATE_READY);
errno = ENOMEM;
return -1;
}
// used to find a netif with the attached driver matching the argument