Mirrors_Framework/nuttx
1
0
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2026-05-22 13:52:22 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

sched/event: init deleted node to avoid null pointer reference

Browse Source 
nxevent_tickwait() will remove the node in failure case(EINTR). If the node
has been deleted in the nxevent_post(), NULL pointer reference will
be triggered after semaphore wait.

Signed-off-by: chao an <anchao@lixiang.com>
This commit is contained in:
chao an
2024-12-26 16:44:52 +08:00
committed by Xiang Xiao
parent 500d193096
commit 54e85075c4
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sched/event/event_post.c
+1 -1
View File
@@ -127,7 +127,7 @@ int nxevent_post(FAR nxevent_t *event, nxevent_mask_t events,
if ((!waitall && ((wait->expect & event->events) != 0)) ||
(waitall && ((wait->expect & event->events) == wait->expect)))
{
list_delete(&wait->node);
list_delete_init(&wait->node);
ret = nxevent_sem_post(&wait->sem);
if (ret < 0)
sched/event/event_wait.c
+3 -3
View File
@@ -127,16 +127,17 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events,
if (delay == UINT32_MAX)
{
ret = nxsem_wait(&wait.sem);
ret = nxsem_wait_uninterruptible(&wait.sem);
}
else
{
ret = nxsem_tickwait(&wait.sem, delay);
ret = nxsem_tickwait_uninterruptible(&wait.sem, delay);
}
/* Destroy local variables */
nxsem_destroy(&wait.sem);
list_delete(&wait.node);
if (ret == 0)
{
@@ -144,7 +145,6 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events,
}
else
{
list_delete(&wait.node);
events = 0;
}
}