This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit b9f59753f733442ec4d38fb4d923e303143e210a Author: Marco Casaroli <[email protected]> AuthorDate: Tue Nov 3 15:39:28 2026 +0100 sched/mqueue: Count the System V message queue table in an int. The table of the queues grows by 10 entries, and its size g_nmsgq was a uint8_t. The 26th growth (more than 250 queues) wrapped g_nmsgq to 4: msgsnd(), msgrcv() and msgctl() of the queues above 4 then gave EINVAL, and the next growth made the table smaller with kmm_realloc() and cleared the entries of live queues. Make g_nmsgq an int. The queue identifier is an int16_t, so msgget() now gives ENOSPC (the POSIX error for the system limit of queues) before the table passes INT16_MAX entries. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <[email protected]> --- sched/mqueue/msginternal.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/sched/mqueue/msginternal.c b/sched/mqueue/msginternal.c index d76788c2cb0..4df6b39e087 100644 --- a/sched/mqueue/msginternal.c +++ b/sched/mqueue/msginternal.c @@ -25,6 +25,7 @@ ****************************************************************************/ #include <assert.h> +#include <stdint.h> #include <nuttx/kmalloc.h> #include "mqueue/msg.h" @@ -40,8 +41,8 @@ * Private Data ****************************************************************************/ -static uint8_t g_nmsgq; /* The number of groups of msgs array */ -static FAR struct msgq_s **g_msgqs; /* The pointer of two layer file descriptors array */ +static int g_nmsgq; /* The number of entries in g_msgqs */ +static FAR struct msgq_s **g_msgqs; /* The queues; the index is the id - 1 */ /**************************************************************************** * Public Data @@ -57,7 +58,7 @@ struct list_node g_msgfreelist; * Name: nxmsg_alloc_internal ****************************************************************************/ -static FAR struct msgq_s *nxmsg_alloc_internal(void) +static int nxmsg_alloc_internal(FAR struct msgq_s **pmsgq) { FAR struct msgq_s *msgq; FAR struct msgq_s **tmp; @@ -66,7 +67,7 @@ static FAR struct msgq_s *nxmsg_alloc_internal(void) msgq = kmm_zalloc(sizeof(struct msgq_s)); if (msgq == NULL) { - return NULL; + return -ENOMEM; } for (i = 0; i < g_nmsgq; i++) @@ -75,16 +76,25 @@ static FAR struct msgq_s *nxmsg_alloc_internal(void) { g_msgqs[i] = msgq; msgq->id = i + 1; - return msgq; + *pmsgq = msgq; + return OK; } } + /* The identifier must fit in the int16_t id of the queue */ + + if (g_nmsgq > INT16_MAX - MQ_PERBLOCK) + { + kmm_free(msgq); + return -ENOSPC; + } + tmp = kmm_realloc(g_msgqs, sizeof(FAR void *) * (g_nmsgq + MQ_PERBLOCK)); if (tmp == NULL) { kmm_free(msgq); - return NULL; + return -ENOMEM; } g_msgqs = tmp; @@ -97,7 +107,8 @@ static FAR struct msgq_s *nxmsg_alloc_internal(void) g_nmsgq += MQ_PERBLOCK; - return msgq; + *pmsgq = msgq; + return OK; } /**************************************************************************** @@ -182,11 +193,12 @@ static void nxmsg_wakeup_list(FAR dq_queue_t *list, FAR int16_t *nwait) int nxmsg_alloc(FAR struct msgq_s **pmsgq) { FAR struct msgq_s *msgq; + int ret; - msgq = nxmsg_alloc_internal(); - if (msgq == NULL) + ret = nxmsg_alloc_internal(&msgq); + if (ret < 0) { - return -ENOMEM; + return ret; } /* Initialize the new named message queue */
