415fe60695
bug:
user thread: hpwork:
timer_create() with SIGEV_THREAD
timer_settime()
irq -> work_queue() add nxsig_notification_worker to Q
timer_delete()
nxsig_cancel_notification()
call nxsig_notification_worker()
work_cancel()
timer_free()
nxsig_notification_worker() used after free
root cause:
work_cancel() can't cancel work completely, the worker may alreay be running.
resolve:
use work_cancel_sync() API to cancel the work completely
Signed-off-by: ligd <liguiding1@xiaomi.com>
|
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| Make.defs | ||
| sig_action.c | ||
| sig_allocpendingsigaction.c | ||
| sig_cleanup.c | ||
| sig_default.c | ||
| sig_deliver.c | ||
| sig_dispatch.c | ||
| sig_findaction.c | ||
| sig_initialize.c | ||
| sig_kill.c | ||
| sig_lowest.c | ||
| sig_nanosleep.c | ||
| sig_notification.c | ||
| sig_pause.c | ||
| sig_pending.c | ||
| sig_ppoll.c | ||
| sig_procmask.c | ||
| sig_pselect.c | ||
| sig_queue.c | ||
| sig_releasependingsigaction.c | ||
| sig_releasependingsignal.c | ||
| sig_removependingsignal.c | ||
| sig_sleep.c | ||
| sig_suspend.c | ||
| sig_tgkill.c | ||
| sig_timedwait.c | ||
| sig_unmaskpendingsignal.c | ||
| sig_usleep.c | ||
| sig_waitinfo.c | ||
| signal.h | ||