From 54e85075c407fb546c58e2d7655d58f17f55f441 Mon Sep 17 00:00:00 2001 From: chao an Date: Thu, 26 Dec 2024 16:44:52 +0800 Subject: [PATCH] sched/event: init deleted node to avoid null pointer reference nxevent_tickwait() will remove the node in failure case(EINTR). If the node has been deleted in the nxevent_post(), NULL pointer reference will be triggered after semaphore wait. Signed-off-by: chao an --- sched/event/event_post.c | 2 +- sched/event/event_wait.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sched/event/event_post.c b/sched/event/event_post.c index 412770fdd8..8963d9b37d 100644 --- a/sched/event/event_post.c +++ b/sched/event/event_post.c @@ -127,7 +127,7 @@ int nxevent_post(FAR nxevent_t *event, nxevent_mask_t events, if ((!waitall && ((wait->expect & event->events) != 0)) || (waitall && ((wait->expect & event->events) == wait->expect))) { - list_delete(&wait->node); + list_delete_init(&wait->node); ret = nxevent_sem_post(&wait->sem); if (ret < 0) diff --git a/sched/event/event_wait.c b/sched/event/event_wait.c index 7ebea08de9..520ae093b0 100644 --- a/sched/event/event_wait.c +++ b/sched/event/event_wait.c @@ -127,16 +127,17 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events, if (delay == UINT32_MAX) { - ret = nxsem_wait(&wait.sem); + ret = nxsem_wait_uninterruptible(&wait.sem); } else { - ret = nxsem_tickwait(&wait.sem, delay); + ret = nxsem_tickwait_uninterruptible(&wait.sem, delay); } /* Destroy local variables */ nxsem_destroy(&wait.sem); + list_delete(&wait.node); if (ret == 0) { @@ -144,7 +145,6 @@ nxevent_mask_t nxevent_tickwait(FAR nxevent_t *event, nxevent_mask_t events, } else { - list_delete(&wait.node); events = 0; } }