fix: guard LOG_D against null thread pointer in rt_ipc_list_resume()#11337
fix: guard LOG_D against null thread pointer in rt_ipc_list_resume()#11337srpatcha wants to merge 3 commits intoRT-Thread:masterfrom
Conversation
|
|
|
👋 感谢您对 RT-Thread 的贡献!Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范,请在你的仓库中执行以下步骤运行代码格式化工作流(如果格式化CI运行失败)。 🛠 操作步骤 | Steps
完成后,提交将自动更新至 如有问题欢迎联系我们,再次感谢您的贡献!💐 |
📌 Code Review Assignment🏷️ Tag: kernelReviewers: GorrayLi ReviewSun hamburger-os lianux-mm wdfk-prog xu18838022837 Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-04-25 16:31 CST)
📝 Review Instructions
|
7c166c9 to
d4b6711
Compare
When rt_susp_list_dequeue() returns RT_NULL (empty suspended list), the LOG_D call dereferences thread->parent.name without a null check, causing a crash in debug builds.
d4b6711 to
ddd2297
Compare
_rt_mb_send_wait, _rt_mq_send_wait, and rt_mq_urgent modified mailbox and message queue data structures before checking overflow conditions. On overflow, they returned errors without rolling back changes, causing state corruption. Moved overflow checks before state modifications. Signed-off-by: Srikanth Patchava <spatchava@meta.com> Signed-off-by: Srikanth Patchava <srikanth.patchava@outlook.com>
|
Hi @BernardXiong, the PR_DESCRIPTION.md file has been removed — it is no longer in this branch. The only changes are the bug fixes in \src/ipc.c. Could you please re-review? Thank you! |
Add comprehensive test suite for rt_mq API covering: - Create/delete and init/detach lifecycle - Send, receive, and urgent message operations - Timeout and non-blocking receive behavior - Queue overflow and boundary conditions - FIFO ordering verification - Cross-thread communication - Message size boundary tests Fix missing spinlock release in IPC error path. Signed-off-by: Srikanth Patchava <spatchava@meta.com>
|
Thank you for your contribution. But there are many CI failed. Please check the CI firstly. And all of kernel releated testcases were moved to |
Fix null pointer dereference in rt_ipc_list_resume()
Problem
rt_ipc_list_resume()insrc/ipc.cdereferencesthreadinLOG_D("resume thread:%s\n", thread->parent.name)without checking ifthreadisRT_NULL. Whenrt_susp_list_dequeue()returns NULL (empty suspended list), this causes a kernel crash in debug builds.Root Cause
The function correctly handles the NULL case by assigning
thread = RT_NULLin the else branch (line 139), but theLOG_Dcall on line 143 unconditionally dereferencesthread->parent.namebefore the function returns. This is only a problem in debug builds sinceLOG_Dis compiled out in release mode, making it a latent bug that surfaces during development.Fix
Wrapped the
LOG_Dcall in aif (thread != RT_NULL)guard to prevent the null pointer dereference.Testing
Impact
Affects RT-Thread users debugging IPC operations. The crash only manifests in debug builds, making it particularly insidious during development.