Per-task monitors use task_mon_slot to determine which slot in the array
to use for the monitor. During destruction, this slot is returned but
this is done before resetting the monitor. As a result, the monitor's
reset is in fact resetting a slot that is outside of the array
(RV_PER_TASK_MONITOR_INIT).

Release the slot only after the reset to avoid out-of-bound memory
access.

Fixes: 30984ccf31b7f ("rv: Refactor da_monitor to minimise macros")
Fixes: 792575348ff70 ("rv/include: Add deterministic automata monitor 
definition via C macros")
Signed-off-by: Gabriele Monaco <[email protected]>
---
 include/rv/da_monitor.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h
index 250888812125..0b7028df08fb 100644
--- a/include/rv/da_monitor.h
+++ b/include/rv/da_monitor.h
@@ -309,10 +309,11 @@ static inline void da_monitor_destroy(void)
                WARN_ONCE(1, "Disabling a disabled monitor: " 
__stringify(MONITOR_NAME));
                return;
        }
-       rv_put_task_monitor_slot(task_mon_slot);
-       task_mon_slot = RV_PER_TASK_MONITOR_INIT;
 
        da_monitor_reset_all();
+
+       rv_put_task_monitor_slot(task_mon_slot);
+       task_mon_slot = RV_PER_TASK_MONITOR_INIT;
 }
 
 #elif RV_MON_TYPE == RV_MON_PER_OBJ
-- 
2.54.0


Reply via email to