Improved network parallel security and improved network bridge buffer security.

7 files changed, 143 insertions, 54 deletions

diff --git a/SylixOS/include/network/lwip/priv/sockets_priv.h b/SylixOS/include/network/lwip/priv/sockets_priv.h
index 3468976..5c7e6bd 100644
--- a/SylixOS/include/network/lwip/priv/sockets_priv.h
+++ b/SylixOS/include/network/lwip/priv/sockets_priv.h
@@ -82,6 +82,11 @@ struct lwip_sock {
   SELWAIT_T select_waiting;
 #ifdef SYLIXOS /* SylixOS Add socket file for event */
   void *file;
+#if LW_CFG_CPU_ATOMIC_EN > 0
+  atomic_t recv_gate;
+#define LWIP_SOCK_RECV_GATE_IDLE  0
+#define LWIP_SOCK_RECV_GATE_BUSY  1
+#endif /* LW_CFG_CPU_ATOMIC_EN */
 #endif /* SYLIXOS */
 #endif /* LWIP_SOCKET_SELECT || LWIP_SOCKET_POLL */
 #if LWIP_NETCONN_FULLDUPLEX
diff --git a/SylixOS/net/lwip/bridge/netbridge.c b/SylixOS/net/lwip/bridge/netbridge.c
index dd0082a..1700840 100644
--- a/SylixOS/net/lwip/bridge/netbridge.c
+++ b/SylixOS/net/lwip/bridge/netbridge.c
@@ -57,7 +57,7 @@
 #define NETBRIDGE_MAC_CACHE_SHIFT   (5) /* default 32 mac address cache for each ethernet port */
 #define NETBRIDGE_MAC_CACHE_SIZE    (1 << NETBRIDGE_MAC_CACHE_SHIFT)
 #define NETBRIDGE_MAC_CACHE_MASK    (NETBRIDGE_MAC_CACHE_SIZE - 1)
-#define NETBRIDGE_MAC_CACHE_TTL     (50) /* default time to live is (s) */
+#define NETBRIDGE_MAC_CACHE_TTL     (60) /* default time to live is (s) */
 
 /* net bridge mac hash */
 typedef struct netbr_mcache {
@@ -90,6 +90,13 @@ static UINT8 netbr_zeroaddr[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
 #define NETBR_LOCK(netbr)   sys_mutex_lock(&((netbr)->lock))
 #define NETBR_UNLOCK(netbr) sys_mutex_unlock(&((netbr)->lock))
 
+/* calculate mac key */
+LW_INLINE static int  netbr_mac_key (UINT8 *mac)
+{
+  register int sum = mac[0] + mac[1] + mac[2] + mac[3] + mac[4] + mac[5];
+  return (sum & NETBRIDGE_MAC_CACHE_MASK);
+}
+
 /* net bridge transmit
    'netdev' is net bridge device */
 static int  netbr_transmit (struct netdev *netdev, struct pbuf *p)
@@ -107,11 +114,11 @@ static int  netbr_transmit (struct netdev *netdev, struct pbuf *p)
   if (!(eh->h_dest[0] & 1)) { /* not broadcast */
     for (pline = netbr->eth_list; pline != NULL; pline = _list_line_get_next(pline)) {
       netbr_eth = (netbr_eth_t *)pline;
-      key = (eh->h_dest[ETH_ALEN - 1] & NETBRIDGE_MAC_CACHE_MASK);
-      mac = &netbr_eth->mcache[key];
-      if (mac->ttl && !lib_memcmp(mac->mac, eh->h_dest, ETH_ALEN)) {
-        found = 1; /* found mac cache */
-        if (netbr_eth->netdev->if_flags & IFF_RUNNING) { /* is linkup ? */
+      if (netbr_eth->netdev->if_flags & IFF_RUNNING) { /* is linkup ? */
+        key = netbr_mac_key(eh->h_dest);
+        mac = &netbr_eth->mcache[key];
+        if (mac->ttl && !lib_memcmp(mac->mac, eh->h_dest, ETH_ALEN)) {
+          found = 1; /* found mac cache */
           netbr_eth->netdev->drv->transmit(netbr_eth->netdev, p); /* send packet to all port with mac address in cache */
         }
       }
@@ -158,6 +165,7 @@ static int netbr_rxmode (struct netdev *netdev, int flags)
 static err_t  netbr_input (struct pbuf *p, struct netif *netif)
 {
   int found, key, pppoe = 0;
+  struct pbuf *q;
   netdev_t *netdev = (netdev_t *)(netif->state); /* sub ethernet device */
   netbr_eth_t *netbr_eth = (netbr_eth_t *)netif->ext_eth;
   netdev_t *netdev_br = netbr_eth->netdev_br; /* bridge device */
@@ -221,7 +229,7 @@ to_br:
   }
   
   /* update mac cache */
-  key = (eh->src.addr[ETH_ALEN - 1] & NETBRIDGE_MAC_CACHE_MASK);
+  key = netbr_mac_key(eh->src.addr);
   mac = &netbr_eth->mcache[key];
   
   SYS_ARCH_PROTECT(lev);
@@ -230,8 +238,14 @@ to_br:
   SYS_ARCH_UNPROTECT(lev);
   
   if (eh->dest.addr[0] & 1) {  /* broadcast */
+    q = pbuf_clone(PBUF_RAW, PBUF_POOL, p);
+    if (!q) {
+      netdev_linkinfo_memerr_inc(&netbr->netdev_br);
+      goto input_p;
+    }
+
 #if ETH_PAD_SIZE
-    pbuf_header(p, -ETH_PAD_SIZE);
+    pbuf_header(q, -ETH_PAD_SIZE);
 #endif
 
     NETBR_LOCK(netbr);
@@ -239,37 +253,42 @@ to_br:
       netbr_eth = (netbr_eth_t *)pline;
       if (netbr_eth->netdev != netdev) {
         if (netbr_eth->netdev->if_flags & IFF_RUNNING) { /* is linkup ? */
-          netbr_eth->netdev->drv->transmit(netbr_eth->netdev, p); /* send to all ports */
+          netbr_eth->netdev->drv->transmit(netbr_eth->netdev, q); /* send to all ports */
         }
       }
     }
     NETBR_UNLOCK(netbr);
-    
-#if ETH_PAD_SIZE
-    pbuf_header(p, ETH_PAD_SIZE);
-#endif
-    goto input_p;
+
+    pbuf_free(q);
   
   } else {  /* unicast */
-    if (!lib_memcmp(eh->dest.addr, netdev_br->hwaddr, ETH_ALEN)) { /* to me? */
-      goto input_p;
+    if (lib_memcmp(eh->dest.addr, netdev_br->hwaddr, ETH_ALEN)) { /* not for me, forward! */
+      if (netif_br->flags2 & NETIF_FLAG2_PROMISC) { /* bridge port is promisc? */
+        q = pbuf_clone(PBUF_RAW, PBUF_POOL, p);
+        if (!q) {
+          netdev_linkinfo_memerr_inc(&netbr->netdev_br);
+          goto input_p;
+        }
+      } else {
+        q = p;
+      }
 
-    } else {  /* forward */
 #if ETH_PAD_SIZE
-      pbuf_header(p, -ETH_PAD_SIZE);
+      pbuf_header(q, -ETH_PAD_SIZE);
 #endif
+
       found = 0;
       
       NETBR_LOCK(netbr);
       for (pline = netbr->eth_list; pline != NULL; pline = _list_line_get_next(pline)) {
         netbr_eth = (netbr_eth_t *)pline;
         if (netbr_eth->netdev != netdev) {
-          key = (eh->dest.addr[ETH_ALEN - 1] & NETBRIDGE_MAC_CACHE_MASK);
-          mac = &netbr_eth->mcache[key];
-          if (mac->ttl && !lib_memcmp(mac->mac, eh->dest.addr, ETH_ALEN)) {
-            found = 1;
-            if (netbr_eth->netdev->if_flags & IFF_RUNNING) { /* is linkup ? */
-              netbr_eth->netdev->drv->transmit(netbr_eth->netdev, p); /* send packet to all port with mac address in cache */
+          if (netbr_eth->netdev->if_flags & IFF_RUNNING) { /* is linkup ? */
+            key = netbr_mac_key(eh->dest.addr);
+            mac = &netbr_eth->mcache[key];
+            if (mac->ttl && !lib_memcmp(mac->mac, eh->dest.addr, ETH_ALEN)) {
+              found = 1;
+              netbr_eth->netdev->drv->transmit(netbr_eth->netdev, q); /* send packet to all port with mac address in cache */
             }
           }
         }
@@ -280,22 +299,19 @@ to_br:
           netbr_eth = (netbr_eth_t *)pline;
           if (netbr_eth->netdev != netdev) { /* not me */
             if (netbr_eth->netdev->if_flags & IFF_RUNNING) { /* is linkup ? */
-              netbr_eth->netdev->drv->transmit(netbr_eth->netdev, p); /* send to all ports */
+              netbr_eth->netdev->drv->transmit(netbr_eth->netdev, q); /* send to all ports */
             }
           }
         }
       }
       NETBR_UNLOCK(netbr);
-      
-#if ETH_PAD_SIZE
-      pbuf_header(p, ETH_PAD_SIZE);
-#endif
-      if (netif_br->flags2 & NETIF_FLAG2_PROMISC) { /* bridge port is promisc? */
-        goto input_p;
+
+      if (q != p) {
+        pbuf_free(q);
+      } else {
+        pbuf_free(p);
+        return (ERR_OK);
       }
-      
-      pbuf_free(p);
-      return (ERR_OK);
     }
   }
   
diff --git a/SylixOS/net/lwip/src/api/sockets.c b/SylixOS/net/lwip/src/api/sockets.c
index dd87367..13ab760 100644
--- a/SylixOS/net/lwip/src/api/sockets.c
+++ b/SylixOS/net/lwip/src/api/sockets.c
@@ -514,6 +514,9 @@ alloc_socket(struct netconn *newconn, int accepted)
       sockets[i].errevent   = 0;
 #ifdef SYLIXOS /* SylixOS Add socket file for event */
       sockets[i].file = NULL;
+#if LW_CFG_CPU_ATOMIC_EN > 0
+      sockets[i].recv_gate.counter = LWIP_SOCK_RECV_GATE_IDLE;
+#endif /* LW_CFG_CPU_ATOMIC_EN */
 #endif /* SYLIXOS */
 #endif /* LWIP_SOCKET_SELECT || LWIP_SOCKET_POLL */
       return i + LWIP_SOCKET_OFFSET;
@@ -1006,6 +1009,19 @@ lwip_recv_tcp(struct lwip_sock *sock, void *mem, size_t len, int flags)
     apiflags |= NETCONN_DONTBLOCK;
   }
 
+#if defined(SYLIXOS) && LW_CFG_CPU_ATOMIC_EN > 0 /* SylixOS Fixed parallel read bug */
+  /* If multiple threads read a same socket at the same time,
+   * there will be a race error
+   */
+  if (__LW_ATOMIC_CAS(&sock->recv_gate,
+                      LWIP_SOCK_RECV_GATE_IDLE,
+                      LWIP_SOCK_RECV_GATE_BUSY) != LWIP_SOCK_RECV_GATE_IDLE) {
+    LWIP_PLATFORM_DIAG(("[NET] Risk: multi-task competition reading the same TCP socket!\n"));
+    sock_set_errno(sock, EWOULDBLOCK);
+    return -1;
+  }
+#endif /* SYLIXOS && LW_CFG_CPU_ATOMIC_EN */
+
   do {
     struct pbuf *p;
     err_t err;
@@ -1023,6 +1039,10 @@ lwip_recv_tcp(struct lwip_sock *sock, void *mem, size_t len, int flags)
                                   err, (void *)p));
 
       if (err != ERR_OK) {
+#if defined(SYLIXOS) && LW_CFG_CPU_ATOMIC_EN > 0 /* SylixOS Fixed parallel read bug */
+        __LW_ATOMIC_SET(LWIP_SOCK_RECV_GATE_IDLE, &sock->recv_gate);
+#endif /* SYLIXOS && LW_CFG_CPU_ATOMIC_EN */
+
         if (recvd > 0) {
           /* already received data, return that (this trusts in getting the same error from
              netconn layer again next time netconn_recv is called) */
@@ -1084,6 +1104,11 @@ lwip_recv_tcp(struct lwip_sock *sock, void *mem, size_t len, int flags)
     apiflags |= NETCONN_DONTBLOCK | NETCONN_NOFIN;
     /* @todo: do we need to support peeking more than one pbuf? */
   } while ((recv_left > 0) && !(flags & MSG_PEEK));
+
+#if defined(SYLIXOS) && LW_CFG_CPU_ATOMIC_EN > 0 /* SylixOS Fixed parallel read bug */
+  __LW_ATOMIC_SET(LWIP_SOCK_RECV_GATE_IDLE, &sock->recv_gate);
+#endif /* SYLIXOS && LW_CFG_CPU_ATOMIC_EN */
+
 lwip_recv_tcp_done:
   if ((recvd > 0) && !(flags & MSG_PEEK)) {
     /* ensure window update after copying all data */
@@ -1178,6 +1203,18 @@ lwip_recvfrom_udp_raw(struct lwip_sock *sock, int flags, struct msghdr *msg, u16
     apiflags = 0;
   }
 
+#if defined(SYLIXOS) && LW_CFG_CPU_ATOMIC_EN > 0 /* SylixOS Fixed parallel read bug */
+  /* If multiple threads read a same socket at the same time,
+   * there will be a race error
+   */
+  if (__LW_ATOMIC_CAS(&sock->recv_gate,
+                      LWIP_SOCK_RECV_GATE_IDLE,
+                      LWIP_SOCK_RECV_GATE_BUSY) != LWIP_SOCK_RECV_GATE_IDLE) {
+    LWIP_PLATFORM_DIAG(("[NET] Risk: multi-task competition reading the same UDP/RAW socket!\n"));
+    return ERR_WOULDBLOCK;
+  }
+#endif /* SYLIXOS && LW_CFG_CPU_ATOMIC_EN */
+
   LWIP_DEBUGF(SOCKETS_DEBUG, ("lwip_recvfrom_udp_raw[UDP/RAW]: top sock->lastdata=%p\n", (void *)sock->lastdata.netbuf));
   /* Check if there is data left from the last recv operation. */
   buf = sock->lastdata.netbuf;
@@ -1189,6 +1226,10 @@ lwip_recvfrom_udp_raw(struct lwip_sock *sock, int flags, struct msghdr *msg, u16
                                 err, (void *)buf));
 
     if (err != ERR_OK) {
+#if defined(SYLIXOS) && LW_CFG_CPU_ATOMIC_EN > 0 /* SylixOS Fixed parallel read bug */
+      __LW_ATOMIC_SET(LWIP_SOCK_RECV_GATE_IDLE, &sock->recv_gate);
+#endif /* SYLIXOS && LW_CFG_CPU_ATOMIC_EN */
+
       return err;
     }
     LWIP_ASSERT("buf != NULL", buf != NULL);
@@ -1300,6 +1341,11 @@ lwip_recvfrom_udp_raw(struct lwip_sock *sock, int flags, struct msghdr *msg, u16
     sock->lastdata.netbuf = NULL;
     netbuf_delete(buf);
   }
+
+#if defined(SYLIXOS) && LW_CFG_CPU_ATOMIC_EN > 0 /* SylixOS Fixed parallel read bug */
+  __LW_ATOMIC_SET(LWIP_SOCK_RECV_GATE_IDLE, &sock->recv_gate);
+#endif /* SYLIXOS && LW_CFG_CPU_ATOMIC_EN */
+
   if (datagram_len) {
     *datagram_len = buflen;
   }
diff --git a/SylixOS/net/lwip/src/core/ipv4/icmp.c b/SylixOS/net/lwip/src/core/ipv4/icmp.c
index cee48c5..9810b9b 100644
--- a/SylixOS/net/lwip/src/core/ipv4/icmp.c
+++ b/SylixOS/net/lwip/src/core/ipv4/icmp.c
@@ -62,7 +62,7 @@
 #define LWIP_ICMP_ECHO_CHECK_INPUT_PBUF_LEN 1
 #endif /* LWIP_ICMP_ECHO_CHECK_INPUT_PBUF_LEN */
 
-/* The amount of data from the original packet to return in a dest-unreachable */
+/* The maximum amount of data from the original packet to return in a dest-unreachable */
 #define ICMP_DEST_UNREACH_DATASIZE 8
 
 static void icmp_send_response(struct pbuf *p, u8_t type, u8_t code);
@@ -344,23 +344,27 @@ icmp_send_response(struct pbuf *p, u8_t type, u8_t code)
   struct icmp_hdr *icmphdr;
   ip4_addr_t iphdr_src;
   struct netif *netif;
+  u16_t response_pkt_len;
 
   /* increase number of messages attempted to send */
   MIB2_STATS_INC(mib2.icmpoutmsgs);
 
-  /* ICMP header + IP header + 8 bytes of data */
-  q = pbuf_alloc(PBUF_IP, sizeof(struct icmp_hdr) + IP_HLEN + ICMP_DEST_UNREACH_DATASIZE,
-                 PBUF_RAM);
+  /* Keep IP header + up to 8 bytes */
+  response_pkt_len = IP_HLEN + ICMP_DEST_UNREACH_DATASIZE;
+  if (p->tot_len < response_pkt_len) response_pkt_len = p->tot_len;
+
+  /* ICMP header + part of original packet */
+  q = pbuf_alloc(PBUF_IP, sizeof(struct icmp_hdr) + response_pkt_len, PBUF_RAM);
   if (q == NULL) {
-    LWIP_DEBUGF(ICMP_DEBUG, ("icmp_time_exceeded: failed to allocate pbuf for ICMP packet.\n"));
+    LWIP_DEBUGF(ICMP_DEBUG, ("icmp_send_response: failed to allocate pbuf for ICMP packet.\n"));
     MIB2_STATS_INC(mib2.icmpouterrors);
     return;
   }
   LWIP_ASSERT("check that first pbuf can hold icmp message",
-              (q->len >= (sizeof(struct icmp_echo_hdr) + IP_HLEN + ICMP_DEST_UNREACH_DATASIZE)));
+              (q->len >= (sizeof(struct icmp_hdr) + response_pkt_len)));
 
   iphdr = (struct ip_hdr *)p->payload;
-  LWIP_DEBUGF(ICMP_DEBUG, ("icmp_time_exceeded from "));
+  LWIP_DEBUGF(ICMP_DEBUG, ("icmp_send_response: Sending ICMP type %02X for packet from ", type));
   ip4_addr_debug_print_val(ICMP_DEBUG, iphdr->src);
   LWIP_DEBUGF(ICMP_DEBUG, (" to "));
   ip4_addr_debug_print_val(ICMP_DEBUG, iphdr->dest);
@@ -372,8 +376,7 @@ icmp_send_response(struct pbuf *p, u8_t type, u8_t code)
   icmphdr->data = 0;
 
   /* copy fields from original packet */
-  SMEMCPY((u8_t *)q->payload + sizeof(struct icmp_echo_hdr), (u8_t *)p->payload,
-          IP_HLEN + ICMP_DEST_UNREACH_DATASIZE);
+  pbuf_copy_partial_pbuf(q, p, response_pkt_len, sizeof(struct icmp_hdr));
 
   ip4_addr_copy(iphdr_src, iphdr->src);
 #ifdef LWIP_HOOK_IP4_ROUTE_SRC
diff --git a/SylixOS/net/lwip/src/core/netif.c b/SylixOS/net/lwip/src/core/netif.c
index a3e354f..301f94b 100644
--- a/SylixOS/net/lwip/src/core/netif.c
+++ b/SylixOS/net/lwip/src/core/netif.c
@@ -1170,11 +1170,12 @@ netif_set_link_callback(struct netif *netif, netif_status_callback_fn link_callb
 /**
  * @ingroup netif
  * Send an IP packet to be received on the same netif (loopif-like).
- * The pbuf is simply copied and handed back to netif->input.
- * In multithreaded mode, this is done directly since netif->input must put
- * the packet on a queue.
- * In callback mode, the packet is put on an internal queue and is fed to
+ * The pbuf is copied and added to an internal queue which is fed to 
  * netif->input by netif_poll().
+ * In multithreaded mode, the call to netif_poll() is queued to be done on the
+ * TCP/IP thread.
+ * In callback mode, the user has the responsibility to call netif_poll() in 
+ * the main loop of their application.
  *
  * @param netif the lwip network interface structure
  * @param p the (IP) packet to 'send'
@@ -1199,7 +1200,9 @@ netif_loop_output(struct netif *netif, struct pbuf *p)
   struct netif *stats_if = netif;
 #endif /* LWIP_HAVE_LOOPIF */
 #endif /* MIB2_STATS */
-  /* SylixOS Remove local schedule loop flag variable */
+#if LWIP_NETIF_LOOPBACK_MULTITHREADING
+  u8_t schedule_poll = 0;
+#endif /* LWIP_NETIF_LOOPBACK_MULTITHREADING */
   SYS_ARCH_DECL_PROTECT(lev);
 
   LWIP_ASSERT("netif_loop_output: invalid netif", netif != NULL);
@@ -1249,12 +1252,18 @@ netif_loop_output(struct netif *netif, struct pbuf *p)
     LWIP_ASSERT("if first != NULL, last must also be != NULL", netif->loop_last != NULL);
     netif->loop_last->next = r;
     netif->loop_last = last;
+#if LWIP_NETIF_LOOPBACK_MULTITHREADING
+    if (netif->loop_schedule) {
+      schedule_poll = 1;
+      netif->loop_schedule = 0;
+    }
+#endif /* LWIP_NETIF_LOOPBACK_MULTITHREADING */
   } else {
     netif->loop_first = r;
     netif->loop_last = last;
 #if LWIP_NETIF_LOOPBACK_MULTITHREADING
     /* No existing packets queued, schedule poll */
-    netif->loop_schedule = 1; /* SylixOS fixed loop event lost bug */
+    schedule_poll = 1;
 #endif /* LWIP_NETIF_LOOPBACK_MULTITHREADING */
   }
   SYS_ARCH_UNPROTECT(lev);
@@ -1265,9 +1274,11 @@ netif_loop_output(struct netif *netif, struct pbuf *p)
 
 #if LWIP_NETIF_LOOPBACK_MULTITHREADING
   /* For multithreading environment, schedule a call to netif_poll */
-  if (netif->loop_schedule) { /* SylixOS fixed loop event lost bug */
-    if (tcpip_try_callback((tcpip_callback_fn)netif_poll, netif) == ERR_OK) {
-      netif->loop_schedule = 0;
+  if (schedule_poll) {
+    if (tcpip_try_callback((tcpip_callback_fn)netif_poll, netif) != ERR_OK) {
+      SYS_ARCH_PROTECT(lev);
+      netif->loop_schedule = 1;
+      SYS_ARCH_UNPROTECT(lev);
     }
   }
 #endif /* LWIP_NETIF_LOOPBACK_MULTITHREADING */
diff --git a/SylixOS/net/lwip/src/core/tcp.c b/SylixOS/net/lwip/src/core/tcp.c
index 9b30c11..fd51e28 100644
--- a/SylixOS/net/lwip/src/core/tcp.c
+++ b/SylixOS/net/lwip/src/core/tcp.c
@@ -801,8 +801,10 @@ tcp_bind(struct tcp_pcb *pcb, const ip_addr_t *ipaddr, u16_t port)
           /* Omit checking for the same port if both pcbs have REUSEADDR set.
              For SO_REUSEADDR, the duplicate-check for a 5-tuple is done in
              tcp_connect. */
+          /* SylixOS Fixed here TCP REUSEADDR only reuse active pcb's address not listen */
           if (!ip_get_option(pcb, SOF_REUSEADDR) ||
-              !ip_get_option(cpcb, SOF_REUSEADDR))
+              !ip_get_option(cpcb, SOF_REUSEADDR) ||
+              (i == TCB_LIST_LISTEN_INDEX))
 #endif /* SO_REUSE */
           {
             /* @todo: check accept_any_ip_version */
@@ -974,7 +976,7 @@ tcp_listen_with_backlog_and_err(struct tcp_pcb *pcb, u8_t backlog, err_t *err)
   lpcb->state = LISTEN;
   lpcb->prio = pcb->prio;
   lpcb->so_options = pcb->so_options;
-  lpcb->netif_idx = NETIF_NO_INDEX;
+  lpcb->netif_idx = pcb->netif_idx; /* SylixOS Fixed here inherit network interface binding */
   lpcb->ttl = pcb->ttl;
   lpcb->tos = pcb->tos;
 #if LWIP_IPV4 && LWIP_IPV6
diff --git a/SylixOS/symbol/symTable/symTable.c b/SylixOS/symbol/symTable/symTable.c
index 519a57e..b4dc0dc 100644
--- a/SylixOS/symbol/symTable/symTable.c
+++ b/SylixOS/symbol/symTable/symTable.c
@@ -74,10 +74,14 @@ static VOIDFUNCPTR              _G_pfuncSymbolTraverseHook = LW_NULL;
 /*********************************************************************************************************
   不可以倒出的符号
 *********************************************************************************************************/
+#if LW_CFG_NET_WIRELESS_EN == 0
+
 static const PCHAR              _G_pcSymHoldBack[] = {
     "pbuf_alloc",
     "pbuf_alloced_custom"
 };
+
+#endif                                                                  /*  !LW_CFG_NET_WIRELESS_EN     */
 /*********************************************************************************************************
 ** 函数名称: __symbolFindHookSet
 ** 功能描述: 设置查找回调函数.
@@ -274,9 +278,11 @@ INT  API_SymbolAddStatic (PLW_SYMBOL  psymbol, INT  iNum)
     }
     __LW_SYMBOL_UNLOCK();                                               /*  解锁符号表                  */
     
+#if LW_CFG_NET_WIRELESS_EN == 0
     for (i = 0; i < ARRAY_SIZE(_G_pcSymHoldBack); i++) {
         API_SymbolDelete(_G_pcSymHoldBack[i], LW_SYMBOL_FLAG_XEN);
     }
+#endif                                                                  /*  !LW_CFG_NET_WIRELESS_EN     */
     
     return  (ERROR_NONE);
 }