lwip: fix crash caused by sys_mbox_free

Fix lwip crashed bug caused by sys_mbox_free()

src/api/api_msg.c

@@ -777,6 +777,14 @@ netconn_alloc(enum netconn_type t, netconn_callback callback)
   }
 #endif
 
+#if ESP_THREAD_SAFE
+  conn->recvmbox_ref = conn->recvmbox;
+  sys_mbox_set_owner(&conn->recvmbox, conn);
+#if LWIP_TCP
+  sys_mbox_set_invalid(&conn->acceptmbox_ref);
+#endif
+#endif
+
 #if LWIP_TCP
   sys_mbox_set_invalid(&conn->acceptmbox);
 #endif
@@ -827,6 +835,18 @@ netconn_free(struct netconn *conn)
     !sys_mbox_valid(&conn->acceptmbox));
 #endif /* LWIP_TCP */
 
+#if ESP_THREAD_SAFE
+  if (conn->recvmbox_ref) {
+    sys_mbox_free(&conn->recvmbox_ref);
+  }
+
+#if LWIP_TCP
+  if (conn->acceptmbox_ref) {
+    sys_mbox_free(&conn->acceptmbox_ref);
+  }
+#endif
+#endif
+
 #if !LWIP_NETCONN_SEM_PER_THREAD
   sys_sem_free(&conn->op_completed);
   sys_sem_set_invalid(&conn->op_completed);
@@ -1487,6 +1507,10 @@ lwip_netconn_do_listen(void *m)
                 msg->err = sys_mbox_new(&msg->conn->acceptmbox, DEFAULT_ACCEPTMBOX_SIZE);
               }
               if (msg->err == ERR_OK) {
+#if ESP_THREAD_SAFE
+                msg->conn->acceptmbox_ref = msg->conn->acceptmbox;
+                sys_mbox_set_owner(&msg->conn->acceptmbox, msg->conn);
+#endif
                 msg->conn->state = NETCONN_LISTEN;
                 msg->conn->pcb.tcp = lpcb;
                 tcp_arg(msg->conn->pcb.tcp, msg->conn);

src/include/lwip/api.h

@@ -233,6 +233,15 @@ struct netconn {
       by the application thread */
   sys_mbox_t acceptmbox;
 #endif /* LWIP_TCP */
+
+#if ESP_THREAD_SAFE
+  /** point to the same mbox as recvmbox */
+  sys_mbox_t recvmbox_ref;
+#if LWIP_TCP
+  /** point to the same mbox as acceptmbox */
+  sys_mbox_t acceptmbox_ref;
+#endif
+#endif
   /** only used for socket layer */
 #if LWIP_SOCKET
   int socket;

src/include/lwip/sys.h

@@ -275,6 +275,17 @@ err_t sys_mbox_trypost(sys_mbox_t *mbox, void *msg);
  *         The returned time has to be accurate to prevent timer jitter!
  */
 u32_t sys_arch_mbox_fetch(sys_mbox_t *mbox, void **msg, u32_t timeout);
+
+#if ESP_THREAD_SAFE
+/**
+ * @ingroup sys_mbox
+ * Set the owner of the mbox
+ * @param mbox mbox to set the owner
+ * @param owner the owner of the mbox, it's a pointer to struct netconn
+ */
+void sys_mbox_set_owner(sys_mbox_t *mbox, void *owner);
+#endif
+
 /* Allow port to override with a macro, e.g. special timeout for sys_arch_mbox_fetch() */
 #ifndef sys_arch_mbox_tryfetch
 /**