nuttx/nuttx-update
1
2
Fork 1
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

sched/event: init deleted node to avoid null pointer reference

Browse source 
nxevent_tickwait() will remove the node in failure case(EINTR). If the node
has been deleted in the nxevent_post(), NULL pointer reference will
be triggered after semaphore wait.

Signed-off-by: chao an <anchao@lixiang.com>
This commit is contained in:
chao an 2024-12-26 16:44:52 +08:00 committed by Xiang Xiao
parent 500d193096
commit 54e85075c4
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sched/event/event_post.c
View file

@ -127,7 +127,7 @@ int nxevent_post(FAR nxevent_t *event, nxevent_mask_t events,
if ((!waitall && ((wait->expect & event->events) != 0)) ||
(waitall && ((wait->expect & event->events) == wait->expect)))
{
list_delete(&wait->node);
list_delete_init(&wait->node);
ret = nxevent_sem_post(&wait->sem);
if (ret < 0)

6
sched/event/event_wait.c
View file

@ -127,16 +127,17 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events,
if (delay == UINT32_MAX)
{
ret = nxsem_wait(&wait.sem);
ret = nxsem_wait_uninterruptible(&wait.sem);
}
else
{
ret = nxsem_tickwait(&wait.sem, delay);
ret = nxsem_tickwait_uninterruptible(&wait.sem, delay);
}
/* Destroy local variables */
nxsem_destroy(&wait.sem);
list_delete(&wait.node);
if (ret == 0)
{
@ -144,7 +145,6 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events,
}
else
{
list_delete(&wait.node);
events = 0;
}
}