From 8ffde7cf16da68ef1062c8219583bc357a542259 Mon Sep 17 00:00:00 2001 From: cuiziwei Date: Mon, 10 Jul 2023 10:08:50 +0800 Subject: [PATCH] nuttx/tls:Setting the candidtate index to null prevents dangling pointers. Signed-off-by: cuiziwei --- libs/libc/tls/tls_destruct.c | 3 ++- sched/task/task_tls_alloc.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/libs/libc/tls/tls_destruct.c b/libs/libc/tls/tls_destruct.c index b0ffc7bb283..37a6f450ad0 100644 --- a/libs/libc/tls/tls_destruct.c +++ b/libs/libc/tls/tls_destruct.c @@ -60,7 +60,7 @@ void tls_destruct(void) DEBUGASSERT(info != NULL); tlsset = info->ta_tlsset; - for (candidate = 0; candidate < CONFIG_TLS_NELEM; candidate++) + for (candidate = CONFIG_TLS_NELEM - 1; candidate >= 0; candidate--) { /* Is this candidate index available? */ @@ -68,6 +68,7 @@ void tls_destruct(void) if (tlsset & mask) { tls_elem_ptr = (FAR void *)tls->tl_elem[candidate]; + tls->tl_elem[candidate] = 0; destructor = info->ta_tlsdtor[candidate]; if (tls_elem_ptr && destructor) { diff --git a/sched/task/task_tls_alloc.c b/sched/task/task_tls_alloc.c index 71f87eaa9b5..16763544fc4 100644 --- a/sched/task/task_tls_alloc.c +++ b/sched/task/task_tls_alloc.c @@ -108,12 +108,13 @@ void task_tls_destruct(void) tls_dtor_t dtor; FAR struct task_info_s *info = task_get_info(); - for (candidate = 0; candidate < CONFIG_TLS_TASK_NELEM; candidate++) + for (candidate = CONFIG_TLS_TASK_NELEM - 1; candidate >= 0; candidate--) { tls_task_ndxset_t mask = (tls_task_ndxset_t)1 << candidate; if ((g_tlsset & mask) != 0) { elem = info->ta_telem[candidate]; + info->ta_telem[candidate] = 0; dtor = g_tlsdtor[candidate]; if (dtor != NULL && elem != 0) {