(nuttx) branch master updated: sched/event: init deleted node to avoid null pointer reference

[xiaoxiang]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 54e85075c4 sched/event: init deleted node to avoid null pointer 
reference
54e85075c4 is described below

commit 54e85075c407fb546c58e2d7655d58f17f55f441
Author: chao an <anc...@lixiang.com>
AuthorDate: Thu Dec 26 16:44:52 2024 +0800

    sched/event: init deleted node to avoid null pointer reference
    
    nxevent_tickwait() will remove the node in failure case(EINTR). If the node
    has been deleted in the nxevent_post(), NULL pointer reference will
    be triggered after semaphore wait.
    
    Signed-off-by: chao an <anc...@lixiang.com>
---
 sched/event/event_post.c | 2 +-
 sched/event/event_wait.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sched/event/event_post.c b/sched/event/event_post.c
index 412770fdd8..8963d9b37d 100644
--- a/sched/event/event_post.c
+++ b/sched/event/event_post.c
@@ -127,7 +127,7 @@ int nxevent_post(FAR nxevent_t *event, nxevent_mask_t 
events,
           if ((!waitall && ((wait->expect & event->events) != 0)) ||
               (waitall && ((wait->expect & event->events) == wait->expect)))
             {
-              list_delete(&wait->node);
+              list_delete_init(&wait->node);
 
               ret = nxevent_sem_post(&wait->sem);
               if (ret < 0)
diff --git a/sched/event/event_wait.c b/sched/event/event_wait.c
index 7ebea08de9..520ae093b0 100644
--- a/sched/event/event_wait.c
+++ b/sched/event/event_wait.c
@@ -127,16 +127,17 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, 
nxevent_mask_t events,
 
       if (delay == UINT32_MAX)
         {
-          ret = nxsem_wait(&wait.sem);
+          ret = nxsem_wait_uninterruptible(&wait.sem);
         }
       else
         {
-          ret = nxsem_tickwait(&wait.sem, delay);
+          ret = nxsem_tickwait_uninterruptible(&wait.sem, delay);
         }
 
       /* Destroy local variables */
 
       nxsem_destroy(&wait.sem);
+      list_delete(&wait.node);
 
       if (ret == 0)
         {
@@ -144,7 +145,6 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, 
nxevent_mask_t events,
         }
       else
         {
-          list_delete(&wait.node);
           events = 0;
         }
     }