From 2f04381aeb18b11a9973b8bf461bdb5cfd46edc5 Mon Sep 17 00:00:00 2001
From: Andrew Leech <andrew.leech@planetinnovation.com.au>
Date: Wed, 21 May 2025 11:16:54 +1000
Subject: [PATCH] extmod/modlwip: Fix crash when calling recv on listening
 socket.

Add check to prevent calling recv on a socket in the listening state.  This
prevents a crash/hard fault when user code mistakenly tries to recv on the
listening socket instead of on the accepted connection.

Add corresponding test case to demonstrate the bug.

Signed-off-by: Andrew Leech <andrew.leech@planetinnovation.com.au>
---
 extmod/modlwip.c                   |  6 +++
 tests/multi_net/tcp_accept_recv.py | 73 ++++++++++++++++++++++++------
 2 files changed, 64 insertions(+), 15 deletions(-)

diff --git a/extmod/modlwip.c b/extmod/modlwip.c
index 65a3412ecb..b53559ed8c 100644
--- a/extmod/modlwip.c
+++ b/extmod/modlwip.c
@@ -825,6 +825,12 @@ static mp_uint_t lwip_tcp_receive(lwip_socket_obj_t *socket, byte *buf, mp_uint_
     // Check for any pending errors
     STREAM_ERROR_CHECK(socket);
 
+    if (socket->state == STATE_LISTENING) {
+        // original socket in listening state, not the accepted connection.
+        *_errno = MP_ENOTCONN;
+        return -1;
+    }
+
     if (socket->incoming.tcp.pbuf == NULL) {
 
         // Non-blocking socket or flag
diff --git a/tests/multi_net/tcp_accept_recv.py b/tests/multi_net/tcp_accept_recv.py
index dee14e3b97..4108a6f8a3 100644
--- a/tests/multi_net/tcp_accept_recv.py
+++ b/tests/multi_net/tcp_accept_recv.py
@@ -1,30 +1,73 @@
-# Test recv on socket that just accepted a connection
+# Test recv on listening socket after accept(), with various listen() arguments
 
 import socket
 
 PORT = 8000
 
+# Test cases for listen() function
+LISTEN_ARGS = [None, 0, 1, 2]  # None means no argument
+
 
 # Server
 def instance0():
     multitest.globals(IP=multitest.get_network_ip())
-    s = socket.socket()
-    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-    s.bind(socket.getaddrinfo("0.0.0.0", PORT)[0][-1])
-    s.listen(1)
     multitest.next()
-    s.accept()
-    try:
-        print("recv", s.recv(10))  # should raise Errno 107 ENOTCONN
-    except OSError as er:
-        print(er.errno in (107, 128))
-    s.close()
+
+    test_num = 0
+    for blocking_mode in [True, False]:
+        for listen_arg in LISTEN_ARGS:
+            test_num += 1
+            s = socket.socket()
+            s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            s.bind(socket.getaddrinfo("0.0.0.0", PORT)[0][-1])
+
+            # Call listen with or without argument based on test case
+            if listen_arg is None:
+                print(f"Test case {test_num}/8: listen() blocking={blocking_mode}")
+                s.listen()
+            else:
+                print(f"Test case {test_num}/8: listen({listen_arg}) blocking={blocking_mode}")
+                s.listen(listen_arg)
+
+            # Signal client that server is ready
+            multitest.broadcast(f"server_ready_{test_num}")
+
+            # Wait for client connection
+            c, _ = s.accept()
+
+            # Set blocking mode after accept
+            s.setblocking(blocking_mode)
+
+            try:
+                print("recv", s.recv(10))  # should raise Errno 107 ENOTCONN
+            except OSError as er:
+                # Verify the error code is either 107 (ENOTCONN) or 128 (ENOTCONN on Windows)
+                print(er.errno in (107, 128))
+
+            # Cleanup
+            c.close()
+            s.close()
+
+            # Signal client we're done with this test case
+            multitest.broadcast(f"server_done_{test_num}")
 
 
 # Client
 def instance1():
     multitest.next()
-    s = socket.socket()
-    s.connect(socket.getaddrinfo(IP, PORT)[0][-1])
-    s.send(b"GET / HTTP/1.0\r\n\r\n")
-    s.close()
+
+    test_num = 0
+    for blocking_mode in [True, False]:
+        for _ in LISTEN_ARGS:
+            test_num += 1
+            # Wait for server to be ready
+            multitest.wait(f"server_ready_{test_num}")
+
+            # Connect to server
+            s = socket.socket()
+            s.connect(socket.getaddrinfo(IP, PORT)[0][-1])
+            s.send(b"GET / HTTP/1.0\r\n\r\n")
+            s.close()
+
+            # Wait for server to finish this test case
+            multitest.wait(f"server_done_{test_num}")