anchao opened a new pull request, #21439:
URL: https://github.com/apache/nuttx/pull/21439
## Summary
In `fdlist_extend()`, the new row array and the per-row descriptor
buffers are allocated while the list lock is dropped. If another
thread expands the file-descriptor list in the meantime (between
`orig_rows` and the requested `row`), the existing code ran
memcpy(fds, list->fl_fds, list->fl_rows * sizeof(FAR struct fd *));
which overwrites `fds[orig_rows .. fl_rows-1]` with pointers already
published by the other thread, permanently leaking the descriptor
blocks this thread just allocated for those rows.
Example: thread A grows 1 -> 4 rows, thread B grows 1 -> 2 first.
When A re-acquires the lock, `fl_rows == 2` falls through the old
`fl_rows >= row` check (2 < 4), so `memcpy` overwrites `fds[1]` and the
block A allocated for row 1 leaks (two blocks if B went to 3 rows).
This can happen on a single CPU via preemption and does not require SMP.
Fix: merge the list row by row instead of a blind `memcpy`. Releasing
the buffers that the already-published list now supplies before copying
in the current pointers, and drop the redundant single-caller request
when `fl_rows >= row`.
## Impact
- New behavior: `fdlist_extend()` merges with a concurrently extended
file list instead of overwriting (and leaking) redundant rows.
- No API or configuration change.
- Build: same configuration.
## Testing
sim/nsh
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
