nuttx/nuttx-mirror
1
2
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2025-01-13 02:48:37 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

sched/event: init deleted node to avoid null pointer reference

Browse source 
nxevent_tickwait() will remove the node in failure case(EINTR). If the node
has been deleted in the nxevent_post(), NULL pointer reference will
be triggered after semaphore wait.

Signed-off-by: chao an <anchao@lixiang.com>
This commit is contained in:
chao an 2024-12-26 16:44:52 +08:00 committed by Xiang Xiao
parent 500d193096
commit 54e85075c4
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sched/event/event_post.c
View file

@ -127,7 +127,7 @@ int nxevent_post(FAR nxevent_t *event, nxevent_mask_t events,
if ((!waitall && ((wait->expect & event->events) != 0)) || if ((!waitall && ((wait->expect & event->events) != 0)) ||
(waitall && ((wait->expect & event->events) == wait->expect))) (waitall && ((wait->expect & event->events) == wait->expect)))
{ {
list_delete(&wait->node); list_delete_init(&wait->node);
ret = nxevent_sem_post(&wait->sem); ret = nxevent_sem_post(&wait->sem);
if (ret < 0) if (ret < 0)

6
sched/event/event_wait.c
View file

@ -127,16 +127,17 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events,
if (delay == UINT32_MAX) if (delay == UINT32_MAX)
{ {
ret = nxsem_wait(&wait.sem); ret = nxsem_wait_uninterruptible(&wait.sem);
} }
else else
{ {
ret = nxsem_tickwait(&wait.sem, delay); ret = nxsem_tickwait_uninterruptible(&wait.sem, delay);
} }
/* Destroy local variables */ /* Destroy local variables */
nxsem_destroy(&wait.sem); nxsem_destroy(&wait.sem);
list_delete(&wait.node);
if (ret == 0) if (ret == 0)
{ {
@ -144,7 +145,6 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events,
} }
else else
{ {
list_delete(&wait.node);
events = 0; events = 0;
} }
} }