mirror of
https://github.com/apache/nuttx.git
synced 2026-08-17 18:28:25 +00:00
27ff1e74e1
nxsig_timedwait parked a pointer to the caller's siginfo buffer in the TCB, for whoever eventually posts the signal to fill in. But the poster fills it in from its own context (another task, a kernel thread, an interrupt), and in a kernel build the caller's buffer is an address in the caller's private address space, which the poster does not share. The write lands wherever the currently active mappings put it: the waiter wakes to find garbage where the signal number should be, and some other process is left with a corrupted page. Flat builds share one address space, which is why this never showed there. Park the stack local in the TCB instead. That is kernel memory, mapped in every context, and it is copied out to the caller's buffer after waking, in the caller's own context, exactly where the pending-signal path already does the same thing. Found on the EIC7700X port by an RTC alarm: the alarm signal, posted from the low-priority work queue, woke a sigwaitinfo caller into an assertion on the unblocking signal number while the init process, whose address space had received the stray write, died of a jump to address zero. With this change the same test arms, waits and wakes cleanly, repeatedly. Assisted-by: Claude:claude-opus-5 Signed-off-by: Justin Hammond <justin@dynam.ac> |
||
|---|---|---|
| .. | ||
| addrenv | ||
| clock | ||
| environ | ||
| event | ||
| group | ||
| hrtimer | ||
| init | ||
| instrument | ||
| irq | ||
| misc | ||
| module | ||
| mqueue | ||
| paging | ||
| pthread | ||
| sched | ||
| semaphore | ||
| signal | ||
| task | ||
| timer | ||
| tls | ||
| wdog | ||
| wqueue | ||
| CMakeLists.txt | ||
| Kconfig | ||
| Makefile | ||