This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit d2489101ac162317975478d39f1127423e42b856 Author: Xiang Xiao <[email protected]> AuthorDate: Fri Sep 11 02:19:53 2026 +0800 fs/aio: skip lio_link teardown for failed submissions in LIO_WAIT mode When a queued operation fails immediately (bad fd, EINVAL, or a failed aio_read/aio_write submission), lio_listio() unconditionally deleted the aiocbp from the request list. In LIO_WAIT mode (or when no sig was requested) the lio_link nodes were never linked into the list, so list_delete() corrupted memory and crashed. Only unlink the node when it was actually linked, i.e. when mode == LIO_NOWAIT and a sigevent was provided. Signed-off-by: tengshuangshuang <[email protected]> --- fs/aio/lio_listio.c | 9 ++++++--- include/aio.h | 20 ++++++++++---------- 2 files changed, 16 insertions(+), 13 deletions(-) diff --git a/fs/aio/lio_listio.c b/fs/aio/lio_listio.c index d42f17ff817..d0316649c39 100644 --- a/fs/aio/lio_listio.c +++ b/fs/aio/lio_listio.c @@ -412,9 +412,12 @@ int lio_listio(int mode, FAR struct aiocb * const list[], int nent, if (status < 0 || aiocbp->aio_result == -EBADF || aiocbp->aio_result == -EINVAL) { - aio_lock(); - list_delete(&aiocbp->lio_link); - aio_unlock(); + if (mode == LIO_NOWAIT && sig) + { + aio_lock(); + list_delete(&aiocbp->lio_link); + aio_unlock(); + } } else { diff --git a/include/aio.h b/include/aio.h index 81dcddd962b..7afb86116a9 100644 --- a/include/aio.h +++ b/include/aio.h @@ -155,16 +155,16 @@ extern "C" * Public Function Prototypes ****************************************************************************/ -int aio_cancel(int, FAR struct aiocb *); -int aio_error(FAR const struct aiocb *); -int aio_fsync(int, FAR struct aiocb *); -int aio_read(FAR struct aiocb *); -ssize_t aio_return(FAR struct aiocb *); -int aio_suspend(FAR const struct aiocb * const[], int, - FAR const struct timespec *); -int aio_write(FAR struct aiocb *); -int lio_listio(int, FAR struct aiocb *restrict const[restrict], int, - FAR struct sigevent *restrict); +int aio_cancel(int fildes, FAR struct aiocb *aiocbp); +int aio_error(FAR const struct aiocb *aiocbp); +int aio_fsync(int op, FAR struct aiocb *aiocbp); +int aio_read(FAR struct aiocb *aiocbp); +ssize_t aio_return(FAR struct aiocb *aiocbp); +int aio_suspend(FAR const struct aiocb * const list[], int nent, + FAR const struct timespec *timeout); +int aio_write(FAR struct aiocb *aiocbp); +int lio_listio(int mode, FAR struct aiocb * const list[], int nent, + FAR struct sigevent *sig); #undef EXTERN #ifdef __cplusplus
