From e994067be03ae070a20ab8cf7a657dbdbf0b156f Mon Sep 17 00:00:00 2001 From: Konstantin Kondrashov Date: Mon, 6 Jul 2026 15:06:36 +0300 Subject: [PATCH] fix(esp_event): protect is_handler_registered traversal with mutex (SEC-219) esp_event_is_handler_registered() walked loop_nodes, base_nodes, id_nodes and handler lists with no lock held, then released an unowned mutex at the 'out:' label via xSemaphoreGive(). Concurrent register/unregister/delete operations can free handler nodes during the unlocked walk (SLIST UAF). The xSemaphoreGive on an unowned recursive mutex corrupts the recursive call-count of any task that legitimately holds the mutex. Fix: - Take loop->mutex with xSemaphoreTakeRecursive before the traversal. - Replace xSemaphoreGive at the 'out:' label with xSemaphoreGiveRecursive so every exit path holds the mutex for exactly one balanced take/give. Closes SEC_219 --- components/esp_event/esp_event_private.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/components/esp_event/esp_event_private.c b/components/esp_event/esp_event_private.c index 773909bc42f..1f09e53dda8 100644 --- a/components/esp_event/esp_event_private.c +++ b/components/esp_event/esp_event_private.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -20,6 +20,8 @@ bool esp_event_is_handler_registered(esp_event_loop_handle_t event_loop, esp_eve esp_event_id_node_t* id_node; esp_event_handler_node_t* handler; + xSemaphoreTakeRecursive(loop->mutex, portMAX_DELAY); + SLIST_FOREACH(loop_node, &(loop->loop_nodes), next) { SLIST_FOREACH(handler, &(loop_node->handlers), next) { if (event_base == ESP_EVENT_ANY_BASE && event_id == ESP_EVENT_ANY_ID && handler->handler_ctx->handler == event_handler) { @@ -52,6 +54,6 @@ bool esp_event_is_handler_registered(esp_event_loop_handle_t event_loop, esp_eve } out: - xSemaphoreGive(loop->mutex); + xSemaphoreGiveRecursive(loop->mutex); return result; }