550c55136e
When server rejects a connection (pending >= backlog), it sends NS_DESTROY to client. The client then calls rpmsg_socket_destroy_ept() which decrements ept->ref to 0 and triggers rpmsg_socket_ept_release(). However, conn->crefs is still 1 at this point, so the connection is not freed. Later when user calls close(), conn->crefs becomes 0 and rpmsg_socket_destroy_ept() is called again, but ept->ref becomes -1, which prevents ept->release_cb() from being called. As a result, rpmsg_socket_free() is never invoked and memory leaks. Fix this by removing the redundant rpmsg_socket_destroy_ept() call in the connect error path. The endpoint cleanup should be handled by the close() path through normal reference counting. Memleak diagram: Client Server connect() ---> rpmsg_socket_ns_bind() | reject (pending >= backlog) |-unbind <--- NS_DESTROY |-rpmsg_socket_destroy_ept() |-rpmsg_socket_ept_release() ept->ref = 0 |-but conn->crefs = 1, not free conn |-return -ECONNRESET to user close() |-conn->crefs ==> 0 |-rpmsg_socket_destroy_ept() ept->ref = -1 |-not call ept->realease_cb() and rpmsg_socket_free() |-will never be called and memory leak occur. Signed-off-by: Bowen Wang <wangbowen6@xiaomi.com> |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Make.defs | ||
| rpmsg.h | ||
| rpmsg_sockif.c | ||