From 78b3b456eb185a365e211148ee47a511b21622c7 Mon Sep 17 00:00:00 2001 From: Lingao Meng Date: Tue, 2 Jun 2026 11:53:22 +0800 Subject: [PATCH] drivers/serial: fix cancellation point leak on uart_tcdrain timeout uart_tcdrain() registers a cancellation point on entry via enter_cancellation_point() (when called with cancelable=true), and the normal exit path calls leave_cancellation_point() before returning. However the timeout path inside the FIFO drain loop returns -ETIMEDOUT directly without going through the normal exit path, leaking one cancellation point reference (tcb->cpcount is left incremented). Over repeated timeouts this counter will desync and prevent pthread_cancel() / pthread_setcancelstate() from behaving correctly for the calling thread. Fix by calling leave_cancellation_point() before the early return, matching the existing exit path. Signed-off-by: Lingao Meng --- drivers/serial/serial.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/serial/serial.c b/drivers/serial/serial.c index d2a7d23fae3..cc734e0a84b 100644 --- a/drivers/serial/serial.c +++ b/drivers/serial/serial.c @@ -604,6 +604,11 @@ static int uart_tcdrain(FAR uart_dev_t *dev, if (elapsed >= timeout) { nxmutex_unlock(&dev->xmit.lock); + if (cancelable) + { + leave_cancellation_point(); + } + return -ETIMEDOUT; } }