Between accept_fn_ storing a raw PCB and accept() picking it up, the
connection could error (RST, timeout). Without an error callback, lwip
frees the PCB silently, leaving a dangling pointer. When accept() later
creates LWIPRawImpl with it, the use-after-free corrupts the heap.
Fix: register a lightweight error callback (no allocation) in accept_fn_
that nulls the array slot when the PCB is freed. accept() checks for
null and skips freed PCBs. After shifting the array, tcp_arg pointers
are updated for remaining entries.
Between accept_fn_ storing a raw PCB and accept() picking it up, the
connection could error (RST, timeout). Without an error callback, lwip
frees the PCB silently, leaving a dangling pointer. When accept() later
creates LWIPRawImpl with it, the use-after-free corrupts the heap.
Fix: register a lightweight error callback (no allocation) in accept_fn_
that nulls the array slot when the PCB is freed. accept() checks for
null and skips freed PCBs. After shifting the array, tcp_arg pointers
are updated for remaining entries.
- Add #if defined(PICO_RP2350) for SRAM end (520KB vs 264KB) so
stack scanning works on both RP2040 and RP2350
- Widen flash range check to 4MB for RP2350
- Add __attribute__((noreturn)) to hard_fault_handler_c
- Mark exc_return parameter as unused via /*exc_return*/
- Build addr2line hint line with all addresses (PC, LR, and BT*)
so users can copy-paste a single command for full decode
Add a crash handler for RP2040 that captures register state and stack
backtrace when a HardFault occurs, stores it in watchdog scratch
registers (which survive reboot), and logs it on the next boot.
- Override weak isr_hardfault with Cortex-M0+ compatible handler
- Save PC, LR, SP to watchdog scratch registers
- Scan stack for return addresses to provide deeper backtrace
- Log crash data immediately after logger initialization
- Add addr2line auto-decoding in CLI serial log viewer
Same pattern as writev — write() calls internal_write_() then
internal_output_(), each acquiring the lock separately. Hold
the lock at the outer scope so inner calls just bump the
recursion counter.
tcp_new() is an lwip core API call that must be bracketed with
the lwip lock on RP2040 per pico-sdk docs. Add LWIP_LOCK() to
socket() and socket_listen() factory functions.
Avoid repeated lock acquire/release cycles per iovec element.
The recursive mutex re-entry in inner calls is nearly free (counter
bump), while the outer lock prevents the expensive IRQ disable/enable
on each iteration.
On RP2040 (Pico W), arduino-pico sets PICO_CYW43_ARCH_THREADSAFE_BACKGROUND=1,
which means lwip callbacks (recv_fn, accept_fn, err_fn) run from a PendSV
interrupt — not the main loop. This allows them to preempt read(), write(),
close(), and accept() at any point, causing race conditions on shared state
like the rx_buf_ pbuf chain.
The most critical race: recv_fn calls pbuf_cat(rx_buf_, pb) while read() is
freeing nodes in the same chain, leading to use-after-free and lwip's
"Creating an infinite loop" assertion panic. This is the root cause of #10681.
Fix: implement RP2040's LwIPLock (previously a no-op) to call
cyw43_arch_lwip_begin/end, which acquires the pico-sdk async_context recursive
mutex. Add LWIP_LOCK() guards to all main-loop lwip API call sites in the
socket layer.
On ESP8266, lwip callbacks run cooperatively from the main loop, so
LwIPLock remains a no-op.
Closes#10681
Split the 256-byte UART read buffer into a separate noinline
read_and_send_() helper so the common "no data" path in loop()
only needs a 32-byte stack frame instead of 288 bytes.
Also reorder checks so api_connection_ == nullptr bails out
first, avoiding the more expensive disconnect detection when
no client is subscribed.
J. Nick Koston