Konstantin Kondrashov 9d2d32524b fix(esp_event): prevent UAF race between post and loop delete (SEC-222) ...

esp_event_post_to() could access loop->queue / loop->mutex after
esp_event_loop_delete() freed them when both ran concurrently.

Introduce esp_event_loop_state_t with:
- posts_in_flight: reference-count incremented atomically (under
  state.lock spinlock) before touching any loop resources, decremented
  on every exit path via goto on_err.
- deleting: atomic_bool set by esp_event_loop_delete() to block new
  posts from entering the critical section.

esp_event_loop_delete() sets deleting=true, then busy-waits (releasing
and re-acquiring loop->mutex each tick) until posts_in_flight reaches
zero before proceeding with teardown.

esp_event_isr_post_to() performs a lock-free atomic_load of deleting as
a best-effort guard; ISR context cannot participate in the spinlock
protocol but the window is documented and accepted.

2026-07-21 15:25:58 +03:00

..

esp_event_internal.h

fix(esp_event): prevent UAF race between post and loop delete (SEC-222)

2026-07-21 15:25:58 +03:00

esp_event_private.h

refactor(tools): Tidy up core component files copyright ignore

2024-01-22 18:07:35 +08:00