espressif / esp-idf

Espressif IoT Development Framework. Official development framework for Espressif SoCs.
Apache License 2.0
13.59k stars 7.27k forks source link

examples/mesh/ip_internal_network: misconfiguration of driver_ifconfig.driver_free_rx_buffer (IDFGH-13310) #14235

Open vjgriswold opened 3 months ago

vjgriswold commented 3 months ago

Answers checklist.

General issue report

In mesh_netif.c, functions mesh_driver_start_root_ap() and mesh_driver_start_node_sta(), the callback function driver_free_rx_buffer is initialized to the function mesh_free() which, in turn, forwards all calls to the heap-based free().

The actual ESP-WIFI-MESH esp_netif initialization configures the driver_free_rx_buffer callback to the function wifi_free() in wifi_netif.c. This correct function forwards all calls to esp_wifi_internal_free_rx_buffer().

It therefore appears highly likely that buffer-free operations may release Rx buffers onto the wrong free-list, corrupting the WiFi buffer-management facility.

zhangyanjiaoesp commented 2 months ago

@vjgriswold Thanks for report, we will check it ASAP.