yushuailong opened a new pull request, #20540:
URL: https://github.com/apache/nuttx/pull/20540
## Summary
Fix two independent race conditions in the kernel work queue
implementation.
### Prevent duplicate notifier scheduling
A triggered notification remained in `g_notifier_pending` until its
callback finished. The implementation used `qualifier == NULL` to mark the
notification as no longer pending, but `NULL` is also a valid qualifier.
A second matching signal could therefore queue the same `work_s` again
while the first callback was running. This could cause duplicate callbacks or
corrupt the notifier and work queue lists.
Remove a matched one-shot notification from the pending list before
queueing its callback. The callback recycles the entry after execution. If
queueing fails, restore the notification to the pending list.
### Protect the immediate-work semaphore post
For zero-delay work, the work item was added to the expired list while
holding the queue lock, but the worker semaphore was posted after releasing the
lock.
A concurrent `work_queue_free()` could acquire the lock, destroy the
semaphore and release the custom queue before the submitter called
`nxsem_post()`.
Post the worker semaphore before releasing the queue lock so the queue
remains valid throughout publication and wakeup.
The two fixes are kept in separate commits.
## Impact
There are no public API or ABI changes.
The notifier fix affects configurations using `CONFIG_WQUEUE_NOTIFIER`.
Each notification setup remains one-shot, including notifications whose
qualifier is `NULL`.
The queue fix affects immediate work submitted with `delay == 0`. It
closes the race with custom queue destruction without changing normal
scheduling semantics.
This PR does not change the broader custom queue lifecycle policy.
Additional synchronization between `work_cancel_sync_wq()` and
`work_queue_free()` is handled separately.
## Testing
Build host: macOS 26.6.2 ARM64, Apple Clang 21.0.0.
Target: sim:ostest.
Build: make completes successfully with LD: nuttx.
Static checks: nxstyle, checkpatch pass.
Runtime smoke test: ./nuttx starts and proceeds through enabled OSTest cases
without an assertion in the observed run.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
