Fix unix socket driver listener lifecycle races

[petermm]

https://ampcode.com/threads/T-019cb8b8-9e4c-7316-9566-c7e3f5f2b6db

Claims to fix #2155

1

Fix a use-after-free race condition in the generic_unix socket driver's close handler, detected by Valgrind during CI gen_tcp tests.

The close handler in socket_consume_mailbox used a two-phase locking pattern: it acquired the glb->listeners lock to NULL-out the socket_data listener pointers, released it, then called sys_unregister_listener (which re-acquires the lock) to remove the listener from the linked list. Between the unlock and re-lock, the event loop thread could also unlink the same listener node via process_listener_handler after the callback returned NULL. The subsequent list_remove in sys_unregister_listener then operated on stale prev/next pointers, corrupting the list or writing to freed memory.

The fix makes the pointer detach and list unlink atomic under a single lock hold by introducing sys_unregister_listener_nolock, a variant that assumes the caller already holds the glb->listeners write lock. The close handler now NULLs the pointers, unlinks the listeners, and releases the lock before freeing the memory.

2

Follow-up analysis also found a separate listener publication race in the same generic_unix socket driver path. Several active and passive listener setup paths registered a listener in the global listener list before publishing the corresponding socket_data->{active,passive}_listener pointer. If the event loop processed that listener in the small window before the pointer assignment, the callback could consume, free, or replace the listener first, and the later assignment would leave socket_data pointing at stale listener memory. That race could surface as random hangs or corruption in CI gen_tcp tests.

Together, these fixes make listener publication, teardown, and unlinking consistent with the event loop's locking model on generic_unix.

This pattern is specific to generic_unix; ESP32 and RP2 use a single global listener for the socket driver subsystem and are not affected.

These changes are made under both the "Apache 2.0" and the "GNU Lesser General
Public License 2.1 or later" license terms (dual license).

SPDX-License-Identifier: Apache-2.0 OR LGPL-2.1-or-later