Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(hw_support): spi bus lock fixed toctou race issue in lock_bg_exit

Browse Source 
Closes https://github.com/espressif/esp-idf/issues/18527
This commit is contained in:
wanckl
2026-09-17 14:42:23 +08:00
parent edef6a8686
commit a16c00376b
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_hw_support/spi_bus_lock.c
+6 -5
View File
@@ -567,14 +567,15 @@ SPI_BUS_LOCK_ISR_ATTR static inline bool bg_exit_core(spi_bus_lock_t *lock, bool
bool ret;
uint32_t status = lock_status_fetch(lock);
if (lock->acquiring_dev) {
if (status & DEV_BG_MASK(lock->acquiring_dev)) {
spi_bus_lock_dev_t *acquiring_dev = (spi_bus_lock_dev_t *)lock->acquiring_dev;
if (acquiring_dev) {
if (status & DEV_BG_MASK(acquiring_dev)) {
BUS_LOCK_DEBUG_EXECUTE_CHECK(lock->acq_dev_bg_active);
ret = false;
} else {
// The request may happen any time, even after we fetched the status.
// The value of `acq_dev_bg_active` is random.
resume_dev_in_isr(lock->acquiring_dev, do_yield);
resume_dev_in_isr(acquiring_dev, do_yield);
ret = true;
}
} else {
@@ -585,10 +586,10 @@ SPI_BUS_LOCK_ISR_ATTR static inline bool bg_exit_core(spi_bus_lock_t *lock, bool
spi_bus_lock_dev_t *desired_dev = NULL;
bool bg_yield = schedule_core(lock, status, &desired_dev);
// A waiting lock owner must be selected once BG is fully finished.
assert(desired_dev);
BUS_LOCK_DEBUG_EXECUTE_CHECK(bg_yield);
BUS_LOCK_DEBUG_EXECUTE_CHECK(desired_dev);
BUS_LOCK_DEBUG_EXECUTE_CHECK(lock->acquiring_dev == desired_dev);
resume_dev_in_isr(lock->acquiring_dev, do_yield);
resume_dev_in_isr(desired_dev, do_yield);
ret = true;
} else {
ret = true;