Skip to content

[hrtimer] fixup use-after-free #8928

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BernardXiong merged 1 commit into from
May 11, 2024
Merged

[hrtimer] fixup use-after-free #8928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion components/drivers/ipc/completion_mp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,11 +326,11 @@ rt_err_t rt_completion_wakeup_by_errno(struct rt_completion *completion,
}

/* safe to assume publication done even on resume failure */
rt_thread_resume(suspend_thread);
RT_ASSERT(rt_atomic_load(&completion->susp_thread_n_flag) ==
RT_WAKING);
IPC_STORE(&completion->susp_thread_n_flag, RT_UNCOMPLETED,
memory_order_release);
rt_thread_resume(suspend_thread);
error = RT_EOK;
break;
}
Expand Down
29 changes: 10 additions & 19 deletions components/drivers/ktime/src/hrtimer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,32 +111,29 @@ static void _sleep_timeout(void *parameter)
rt_completion_done(&timer->completion);
}

static void _set_next_timeout(void);
static void _set_next_timeout_n_unlock(rt_base_t level);
static void _timeout_callback(void *parameter)
{
rt_ktime_hrtimer_t timer;
timer = (rt_ktime_hrtimer_t)parameter;
rt_base_t level;

level = rt_spin_lock_irqsave(&_spinlock);
_nowtimer = RT_NULL;
rt_list_remove(&(timer->row));

if (timer->parent.flag & RT_TIMER_FLAG_ACTIVATED)
{
timer->timeout_func(timer->parameter);
}

level = rt_spin_lock_irqsave(&_spinlock);
_nowtimer = RT_NULL;
rt_list_remove(&(timer->row));
rt_spin_unlock_irqrestore(&_spinlock, level);

_set_next_timeout();
_set_next_timeout_n_unlock(level);
}

static void _set_next_timeout(void)
static void _set_next_timeout_n_unlock(rt_base_t level)
{
rt_ktime_hrtimer_t t;
rt_base_t level;

level = rt_spin_lock_irqsave(&_spinlock);
if (&_timer_list != _timer_list.prev)
{
t = rt_list_entry((&_timer_list)->next, struct rt_ktime_hrtimer, row);
Expand Down Expand Up @@ -202,9 +199,6 @@ rt_err_t rt_ktime_hrtimer_start(rt_ktime_hrtimer_t timer)
/* parameter check */
RT_ASSERT(timer != RT_NULL);

/* notify the timer stop event */
rt_completion_wakeup_by_errno(&timer->completion, RT_ERROR);

level = rt_spin_lock_irqsave(&_spinlock);
rt_list_remove(&timer->row); /* remove timer from list */
/* change status of timer */
Expand All @@ -228,9 +222,8 @@ rt_err_t rt_ktime_hrtimer_start(rt_ktime_hrtimer_t timer)
}
rt_list_insert_after(timer_list, &(timer->row));
timer->parent.flag |= RT_TIMER_FLAG_ACTIVATED;
rt_spin_unlock_irqrestore(&_spinlock, level);

_set_next_timeout();
_set_next_timeout_n_unlock(level);

return RT_EOK;
}
Expand All @@ -250,9 +243,8 @@ rt_err_t rt_ktime_hrtimer_stop(rt_ktime_hrtimer_t timer)
_nowtimer = RT_NULL;
rt_list_remove(&timer->row);
timer->parent.flag &= ~RT_TIMER_FLAG_ACTIVATED; /* change status */
rt_spin_unlock_irqrestore(&_spinlock, level);

_set_next_timeout();
_set_next_timeout_n_unlock(level);

return RT_EOK;
}
Expand Down Expand Up @@ -344,8 +336,7 @@ rt_err_t rt_ktime_hrtimer_detach(rt_ktime_hrtimer_t timer)
{
_nowtimer = RT_NULL;
rt_list_remove(&timer->row);
rt_spin_unlock_irqrestore(&_spinlock, level);
_set_next_timeout();
_set_next_timeout_n_unlock(level);
}
else
{
Expand Down
1 change: 1 addition & 0 deletions src/cpu_mp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,7 @@ RTM_EXPORT(rt_cpus_lock_status_restore);

/* A safe API with debugging feature to be called in most codes */

#undef rt_cpu_get_id
/**
* @brief Get logical CPU ID
*
Expand Down