(nuttx) branch master updated: sched/timer: a timer handle works only in its own process

[ligd]

This is an automated email from the ASF dual-hosted git repository.

GUIDINGLI pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new e65ca991280 sched/timer: a timer handle works only in its own process
e65ca991280 is described below

commit e65ca991280886ff8f6335108f7591382b8c6371
Author: Royyan Zahir <roy...@gmail.com>
AuthorDate: Wed Sep 30 09:54:33 2026 +0400

    sched/timer: a timer handle works only in its own process
    
    timer_gethandle() accepted any allocated timer in the system, so a
    process could set, read or delete another process's timer by its handle.
    Accept a handle only from a thread of the owner's process. The expiry
    callback runs in interrupt context, where the current task is unrelated,
    and is exempt.
    
    Signed-off-by: Royyan Zahir <roy...@gmail.com>
---
 sched/timer/timer_initialize.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sched/timer/timer_initialize.c b/sched/timer/timer_initialize.c
index 2a29328b8be..fda156a1104 100644
--- a/sched/timer/timer_initialize.c
+++ b/sched/timer/timer_initialize.c
@@ -35,6 +35,7 @@
 #include <nuttx/queue.h>
 #include <nuttx/trace.h>
 
+#include "sched/sched.h"
 #include "timer/timer.h"
 
 #ifndef CONFIG_DISABLE_POSIX_TIMERS
@@ -202,6 +203,16 @@ FAR struct posix_timer_s *timer_gethandle(timer_t timerid)
       spin_unlock_irqrestore(&g_locktimers, flags);
     }
 
+  if (timer != NULL && !up_interrupt_context())
+    {
+      FAR struct tcb_s *owner = nxsched_get_tcb(timer->pt_owner);
+
+      if (owner == NULL || owner->group != this_task()->group)
+        {
+          timer = NULL;
+        }
+    }
+
   return timer;
 }