This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new bebe7af6019 fs/v9fs: Wait for the reply even if a signal wakes the
caller.
bebe7af6019 is described below
commit bebe7af601960e76c06b88fa7bba4cf3030f5519
Author: Marco Casaroli <[email protected]>
AuthorDate: Mon Oct 12 16:19:48 2026 +0200
fs/v9fs: Wait for the reply even if a signal wakes the caller.
v9fs_client_rpc() ignored the result of nxsem_wait(). When a signal
woke the caller, it returned -EIO while the request was still in the
transport. The reply then went into the payload and the response
buffers of a stack frame that was already gone: the caller got an I/O
error and the kernel stack of another thread was corrupted.
Wait with nxsem_wait_uninterruptible(), as rpmsgfs does.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Marco Casaroli <[email protected]>
---
fs/v9fs/client.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/v9fs/client.c b/fs/v9fs/client.c
index 44923caae6a..bc2d5fbdaa2 100644
--- a/fs/v9fs/client.c
+++ b/fs/v9fs/client.c
@@ -632,7 +632,13 @@ static int v9fs_client_rpc(FAR struct v9fs_transport_s
*transport,
return ret;
}
- nxsem_wait(&payload.resp);
+ /* The transport writes the reply into payload and into the buffers of
+ * the caller, all on the stack: wait for it even if a signal wakes this
+ * thread.
+ */
+
+ nxsem_wait_uninterruptible(&payload.resp);
+
nxsem_destroy(&payload.resp);
return payload.ret;
