From ce88bc212d0a3b7eec4e31d53bdc6dab3960b0c1 Mon Sep 17 00:00:00 2001 From: Jussi Kivilinna Date: Thu, 7 Dec 2017 07:12:11 -0600 Subject: [PATCH] From c73dd8973accd312ca7675fde044df80e9cc62d5 Mon Sep 17 00:00:00 2001 From: Jussi Kivilinna Date: Thu, 7 Dec 2017 13:00:14 +0200 Subject: [PATCH] drivers/pipes: poll: fix off-by-one error in calculation of bytes in the buffer Buffer calculation in pipe poll setup is off-by-one when read indexis larger than write index. This causes poll() not getting POLLINwhen buffer has one byte as calculation gives zero bytes in buffer. Reproducible with: { char buf[8] = { 0, }; int fds[2]; struct pollfd in_pfd; pipe2(fds, 8); write(fds[1], buf, 7); read(fds[0], buf, 7); write(fds[1], buf, 1); in_pfd.fd = fds[0]; in_pfd.events = POLLIN; ret = poll(&in_pfd, 1, -1); // pipe bug => stuck waiting assert(ret == 1); } --- drivers/pipes/pipe_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pipes/pipe_common.c b/drivers/pipes/pipe_common.c index 03509461e35..532e7056718 100644 --- a/drivers/pipes/pipe_common.c +++ b/drivers/pipes/pipe_common.c @@ -704,7 +704,7 @@ int pipecommon_poll(FAR struct file *filep, FAR struct pollfd *fds, } else { - nbytes = (dev->d_bufsize - 1) + dev->d_wrndx - dev->d_rdndx; + nbytes = dev->d_bufsize + dev->d_wrndx - dev->d_rdndx; } /* Notify the POLLOUT event if the pipe is not full, but only if