mirror of
https://github.com/apache/nuttx.git
synced 2026-09-14 06:30:31 +00:00
a3d4802ff8
Same issue as the previous commit, on the receive side: uart_read() advances recv.tail from thread context without holding the critical section, but the recvbuf batch path of uart_recvchars() reads recv.tail several times (the full check, the watermark count and the free-space computation). If uart_read() moves and wraps the index in between, the computed free space goes negative and is passed to recvbuf() as a huge size_t, which lets the driver store past the end of the ring buffer. Read recv.tail once per loop iteration and derive everything from that snapshot. The consumer only ever moves the index forward, so a stale snapshot merely stores less now. Assisted-by: Claude Code Signed-off-by: raiden00pl <raiden00@railab.me> |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Kconfig-16550 | ||
| Kconfig-cmsdk | ||
| Kconfig-lpuart | ||
| Kconfig-pci | ||
| Kconfig-pl011 | ||
| Kconfig-sci | ||
| Kconfig-uart | ||
| Kconfig-usart | ||
| Kconfig-xlnxps | ||
| Make.defs | ||
| ptmx.c | ||
| pty.c | ||
| pty.h | ||
| serial.c | ||
| serial_cmsdk.c | ||
| serial_dma.c | ||
| serial_gdbstub.c | ||
| serial_io.c | ||
| uart_16550.c | ||
| uart_bth4.c | ||
| uart_bth5.c | ||
| uart_hostfs.c | ||
| uart_pci_16550.c | ||
| uart_pl011.c | ||
| uart_ram.c | ||
| uart_rpmsg.c | ||
| uart_rpmsg_raw.c | ||
| uart_xlnx_ps.c | ||