Skip to content

fix: guard LOG_D against null thread pointer in rt_ipc_list_resume() #11337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
srpatcha wants to merge 2 commits into
base: master
Choose a base branch
from
+33 −32
Open

fix: guard LOG_D against null thread pointer in rt_ipc_list_resume() #11337

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef9d8f4
fix(ipc): guard LOG_D against null thread pointer in rt_susp_list_deq…
srpatcha May 6, 2026
626ca31
fix(ipc): check overflow before modifying IPC state in send functions
srpatcha May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 33 additions & 32 deletions src/ipc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@
* 2022-04-08 Stanley Correct descriptions
* 2022-10-15 Bernard add nested mutex feature
* 2022-10-16 Bernard add prioceiling feature in mutex
* 2023-04-16 Xin-zheqi redesigen queue recv and send function return real message size
* 2023-04-16 Xin-zheqi redesign queue recv and send function return real message size
* 2023-09-15 xqyjlj perf rt_hw_interrupt_disable/enable
*/

Expand Down Expand Up @@ -140,7 +140,7 @@ struct rt_thread *rt_susp_list_dequeue(rt_list_t *susp_list, rt_err_t thread_err
}
rt_sched_unlock(slvl);

LOG_D("resume thread:%s\n", thread->parent.name);
LOG_D("resume thread:%s\n", (thread == RT_NULL) ? "NULL" : thread->parent.name);

return thread;
}
Expand Down Expand Up @@ -2661,23 +2661,21 @@ static rt_err_t _rt_mb_send_wait(rt_mailbox_t mb,
}
}

if(mb->entry >= RT_MB_ENTRY_MAX)
{
rt_spin_unlock_irqrestore(&(mb->spinlock), level);
return -RT_EFULL; /* value overflowed */
}

/* set ptr */
mb->msg_pool[mb->in_offset] = value;
/* increase input offset */
++ mb->in_offset;
if (mb->in_offset >= mb->size)
mb->in_offset = 0;

if(mb->entry < RT_MB_ENTRY_MAX)
{
/* increase message entry */
mb->entry ++;
}
else
{
rt_spin_unlock_irqrestore(&(mb->spinlock), level);
return -RT_EFULL; /* value overflowed */
}
/* increase message entry */
mb->entry ++;

/* resume suspended thread */
if (!rt_list_isempty(&mb->parent.suspend_thread))
Expand Down Expand Up @@ -3503,6 +3501,16 @@ static rt_err_t _rt_mq_send_wait(rt_mq_t mq,

/* disable interrupt */
level = rt_spin_lock_irqsave(&(mq->spinlock));

if(mq->entry >= RT_MQ_ENTRY_MAX)
{
/* return message to free list */
msg->next = (struct rt_mq_message *)mq->msg_queue_free;
mq->msg_queue_free = msg;
rt_spin_unlock_irqrestore(&(mq->spinlock), level);
return -RT_EFULL; /* value overflowed */
}

#ifdef RT_USING_MESSAGEQUEUE_PRIORITY
msg->prio = prio;
if (mq->msg_queue_head == RT_NULL)
Expand Down Expand Up @@ -3544,16 +3552,8 @@ static rt_err_t _rt_mq_send_wait(rt_mq_t mq,
mq->msg_queue_head = msg;
#endif

if(mq->entry < RT_MQ_ENTRY_MAX)
{
/* increase message entry */
mq->entry ++;
}
else
{
rt_spin_unlock_irqrestore(&(mq->spinlock), level);
return -RT_EFULL; /* value overflowed */
}
/* increase message entry */
mq->entry ++;

/* resume suspended thread */
if (!rt_list_isempty(&mq->parent.suspend_thread))
Expand Down Expand Up @@ -3694,6 +3694,15 @@ rt_err_t rt_mq_urgent(rt_mq_t mq, const void *buffer, rt_size_t size)

level = rt_spin_lock_irqsave(&(mq->spinlock));

if(mq->entry >= RT_MQ_ENTRY_MAX)
{
/* return message to free list */
msg->next = (struct rt_mq_message *)mq->msg_queue_free;
mq->msg_queue_free = msg;
rt_spin_unlock_irqrestore(&(mq->spinlock), level);
return -RT_EFULL; /* value overflowed */
}

/* link msg to the beginning of message queue */
msg->next = (struct rt_mq_message *)mq->msg_queue_head;
mq->msg_queue_head = msg;
Expand All @@ -3702,16 +3711,8 @@ rt_err_t rt_mq_urgent(rt_mq_t mq, const void *buffer, rt_size_t size)
if (mq->msg_queue_tail == RT_NULL)
mq->msg_queue_tail = msg;

if(mq->entry < RT_MQ_ENTRY_MAX)
{
/* increase message entry */
mq->entry ++;
}
else
{
rt_spin_unlock_irqrestore(&(mq->spinlock), level);
return -RT_EFULL; /* value overflowed */
}
/* increase message entry */
mq->entry ++;

/* resume suspended thread */
if (!rt_list_isempty(&mq->parent.suspend_thread))
Expand Down
Loading