Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp_event): protect is_handler_registered traversal with mutex (SEC-219)

Browse Source 
esp_event_is_handler_registered() walked loop_nodes, base_nodes, id_nodes
and handler lists with no lock held, then released an unowned mutex at the
'out:' label via xSemaphoreGive().

Concurrent register/unregister/delete operations can free handler nodes
during the unlocked walk (SLIST UAF). The xSemaphoreGive on an unowned
recursive mutex corrupts the recursive call-count of any task that
legitimately holds the mutex.

Fix:
- Take loop->mutex with xSemaphoreTakeRecursive before the traversal.
- Replace xSemaphoreGive at the 'out:' label with xSemaphoreGiveRecursive
  so every exit path holds the mutex for exactly one balanced take/give.

Closes SEC_219
This commit is contained in:
Konstantin Kondrashov
2026-07-21 16:50:53 +03:00
parent 72d283dade
commit e994067be0
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_event/esp_event_private.c
+4 -2
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2018-2024 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2018-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -20,6 +20,8 @@ bool esp_event_is_handler_registered(esp_event_loop_handle_t event_loop, esp_eve
esp_event_id_node_t* id_node; esp_event_id_node_t* id_node;
esp_event_handler_node_t* handler; esp_event_handler_node_t* handler;
xSemaphoreTakeRecursive(loop->mutex, portMAX_DELAY);
SLIST_FOREACH(loop_node, &(loop->loop_nodes), next) { SLIST_FOREACH(loop_node, &(loop->loop_nodes), next) {
SLIST_FOREACH(handler, &(loop_node->handlers), next) { SLIST_FOREACH(handler, &(loop_node->handlers), next) {
if (event_base == ESP_EVENT_ANY_BASE && event_id == ESP_EVENT_ANY_ID && handler->handler_ctx->handler == event_handler) { if (event_base == ESP_EVENT_ANY_BASE && event_id == ESP_EVENT_ANY_ID && handler->handler_ctx->handler == event_handler) {
@@ -52,6 +54,6 @@ bool esp_event_is_handler_registered(esp_event_loop_handle_t event_loop, esp_eve
} }
out: out:
xSemaphoreGive(loop->mutex); xSemaphoreGiveRecursive(loop->mutex);
return result; return result;
} }