net/can,udp: fix conn unlock position in callback

Move conn_unlock() after the data event handling in can_callback()
and udp_callback(). Previously, the connection lock was released
immediately after devif_conn_event(), leaving the subsequent
can_data_event()/net_dataevent() and read-ahead buffer operations
unprotected. This could lead to a race condition where another
context modifies the connection state while data is being stored.

Hold the lock until the entire callback processing is complete to
ensure thread safety.

Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>

Author: zhhyu7

net/can/can_callback.c

@@ -152,7 +152,6 @@ uint32_t can_callback(FAR struct net_driver_s *dev,
 
       conn_lock(&conn->sconn);
       flags = devif_conn_event(dev, flags, conn->sconn.list);
-      conn_unlock(&conn->sconn);
 
       /* Either we did not get the lock or there is no application listening
        * If we did not get a lock we store the frame in the read-ahead buffer
@@ -164,6 +163,8 @@ uint32_t can_callback(FAR struct net_driver_s *dev,
 
           flags = can_data_event(dev, conn, flags);
         }
+
+      conn_unlock(&conn->sconn);
     }
 
   return flags;

net/udp/udp_callback.c

@@ -319,14 +319,15 @@ uint32_t udp_callback(FAR struct net_driver_s *dev,
 
       conn_lock(&conn->sconn);
       flags = devif_conn_event(dev, flags, conn->sconn.list);
-      conn_unlock(&conn->sconn);
 
       if ((flags & UDP_NEWDATA) != 0)
         {
           /* Data was not handled.. dispose of it appropriately */
 
           flags = net_dataevent(dev, conn, flags);
         }
+
+      conn_unlock(&conn->sconn);
     }
 
   return flags;