mirror of
https://github.com/apache/nuttx.git
synced 2026-08-01 20:28:58 +00:00
5a7f1b5005
Some checks are pending
Build Documentation / build-html (push) Waiting to run
MemBrowse Memory Report / changes-filter (push) Waiting to run
MemBrowse Memory Report / load-targets (push) Waiting to run
MemBrowse Memory Report / identical (push) Blocked by required conditions
MemBrowse Memory Report / analyze (push) Blocked by required conditions
syslog_write_foreach() compares an unsigned count against a signed
accumulator:
size_t nwritten = 0;
ssize_t nwritten_max = -EIO;
...
if (nwritten > nwritten_max)
{
nwritten_max = nwritten;
}
return nwritten_max;
The usual arithmetic conversions promote nwritten_max to size_t, so -EIO
becomes 4294967291 on a 32-bit target, and the comparison is never true.
nwritten_max keeps its initial value and the function returns -EIO no
matter how many bytes actually went out. Observed under gdb on a running
target: nwritten == 64, nwritten_max == -5, (nwritten > nwritten_max) == 0.
Most callers discard the result -- syslog() itself returns void -- so this
is normally invisible. It becomes fatal when /dev/console is backed by
syslog_console_write(), because then stdio acts on it.
lib_fflush_unlocked() sees a negative return, sets __FS_FLAG_ERROR and
returns early, before resetting fs_bufpos. The bytes have already been
emitted, but the buffer is never cleared, so every subsequent stdio call
re-flushes the same CONFIG_STDIO_BUFFER_SIZE bytes. The console fills
with one repeated fragment and the system makes no further progress.
Reaching that state needs CONFIG_CONSOLE_SYSLOG=y together with no driver
claiming /dev/console ahead of syslog_console_init(). Three in-tree
defconfigs qualify: x86/qemu-i486:ostest, renesas/skp16c26:ostest and
x86_64/qemu-intel64:earlyfb. The other 56 CONSOLE_SYSLOG configurations
have a serial console that registers /dev/console first, which is why this
has gone unnoticed.
Introduced by
|
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Make.defs | ||
| ramlog.c | ||
| syslog.h | ||
| syslog_channel.c | ||
| syslog_chardev.c | ||
| syslog_console.c | ||
| syslog_consolechannel.c | ||
| syslog_devchannel.c | ||
| syslog_device.c | ||
| syslog_early.c | ||
| syslog_filechannel.c | ||
| syslog_flush.c | ||
| syslog_initialize.c | ||
| syslog_intbuffer.c | ||
| syslog_rpmsg.c | ||
| syslog_rpmsg.h | ||
| syslog_rpmsg_server.c | ||
| syslog_stream.c | ||
| syslog_write.c | ||
| vsyslog.c | ||
| vsyslog_rfc5424.c | ||