This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 24662191008ea68d10efa6bcbebbf849206540e8 Author: Xiang Xiao <[email protected]> AuthorDate: Fri Sep 11 02:18:53 2026 +0800 fs/aio: guard against all-NULL aiocb lists in lio_listio() When lio_listio() is called with LIO_NOWAIT and a non-NULL sig, and no I/O could be queued (or all entries are LIO_NOP/NULL), the completion notification dereferences a NULL aiocbp picked from an empty iteration, crashing nxsig_notification(). Scan the list for any non-NULL entry before delivering the notification, and skip it entirely when the list contains only NULL entries. Signed-off-by: zhengyu16 <[email protected]> --- fs/aio/lio_listio.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/aio/lio_listio.c b/fs/aio/lio_listio.c index c2e8610eb53..d42f17ff817 100644 --- a/fs/aio/lio_listio.c +++ b/fs/aio/lio_listio.c @@ -495,6 +495,25 @@ int lio_listio(int mode, FAR struct aiocb * const list[], int nent, * removed, so manually signal the client */ + /* Find a non-NULL aiocbp */ + + if (aiocbp == NULL) + { + for (i = 0; i < nent; i++) + { + if (list[i]) + { + aiocbp = list[i]; + break; + } + } + + if (aiocbp == NULL) + { + goto out; + } + } + status = nxsig_notification(nxsched_getpid(), &aiocbp->lio_sigevent, SI_ASYNCIO, @@ -516,6 +535,7 @@ int lio_listio(int mode, FAR struct aiocb * const list[], int nent, * Just return now. */ +out: if (ret < 0) { set_errno(retcode);
