patrick/zephyr
1
0
Fork 0
Code Issues Pull requests Actions 8 Packages Projects Releases Wiki Activity

lib: fdtable: fix z_free_fd multiple calls fd leak

Browse source 
Multiple calls of z_free_fd against fd with refcount equal 0 are causing
descriptor table entry leak by decrementing refcount below 0.
This patch prevents decrementing refcount below zero.

Signed-off-by: Grzegorz Kostka <grzegorz@mobility.cloud>
This commit is contained in:
Grzegorz Kostka 2020-09-07 13:11:15 +02:00 committed by Maureen Helm
parent 1740dfc8c2
commit cccb1908ac
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
lib/os/fdtable.c
View file

@ -63,7 +63,19 @@ static int z_fd_ref(int fd)
static int z_fd_unref(int fd)
{
int old_rc = atomic_dec(&fdtable[fd].refcount);
atomic_val_t old_rc;
/* Reference counter must be checked to avoid decrement refcount below
* zero causing file descriptor leak. Loop statement below executes
* atomic decrement if refcount value is grater than zero. Otherwise,
* refcount is not going to be written.
*/
do {
old_rc = atomic_get(&fdtable[fd].refcount);
if (!old_rc) {
return 0;
}
} while (!atomic_cas(&fdtable[fd].refcount, old_rc, old_rc - 1));
if (old_rc != 1) {
return old_rc - 1;