Skip to content

Commit e7754b1

Browse files
Srikanth PatchavaSrikanth Patchava
authored andcommitted
fix: guard LOG_D against null thread pointer in rt_ipc_list_resume()
When rt_susp_list_dequeue() returns RT_NULL (empty suspended list), the LOG_D call dereferences thread->parent.name without a null check, causing a crash in debug builds.
1 parent 96c0ce2 commit e7754b1

2 files changed

Lines changed: 27 additions & 2 deletions

File tree

PR_DESCRIPTION.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Fix null pointer dereference in rt_ipc_list_resume()
2+
3+
## Problem
4+
5+
`rt_ipc_list_resume()` in `src/ipc.c` dereferences `thread` in `LOG_D("resume thread:%s\n", thread->parent.name)` without checking if `thread` is `RT_NULL`. When `rt_susp_list_dequeue()` returns NULL (empty suspended list), this causes a kernel crash in debug builds.
6+
7+
## Root Cause
8+
9+
The function correctly handles the NULL case by assigning `thread = RT_NULL` in the else branch (line 139), but the `LOG_D` call on line 143 unconditionally dereferences `thread->parent.name` before the function returns. This is only a problem in debug builds since `LOG_D` is compiled out in release mode, making it a latent bug that surfaces during development.
10+
11+
## Fix
12+
13+
Wrapped the `LOG_D` call in a `if (thread != RT_NULL)` guard to prevent the null pointer dereference.
14+
15+
## Testing
16+
17+
- Trigger an IPC resume on an empty suspended list with debug logging enabled.
18+
- The system should no longer crash and should return RT_NULL gracefully.
19+
20+
## Impact
21+
22+
Affects RT-Thread users debugging IPC operations. The crash only manifests in debug builds, making it particularly insidious during development.

src/ipc.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
* 2022-04-08 Stanley Correct descriptions
4545
* 2022-10-15 Bernard add nested mutex feature
4646
* 2022-10-16 Bernard add prioceiling feature in mutex
47-
* 2023-04-16 Xin-zheqi redesigen queue recv and send function return real message size
47+
* 2023-04-16 Xin-zheqi redesign queue recv and send function return real message size
4848
* 2023-09-15 xqyjlj perf rt_hw_interrupt_disable/enable
4949
*/
5050

@@ -140,7 +140,10 @@ struct rt_thread *rt_susp_list_dequeue(rt_list_t *susp_list, rt_err_t thread_err
140140
}
141141
rt_sched_unlock(slvl);
142142

143-
LOG_D("resume thread:%s\n", thread->parent.name);
143+
if (thread != RT_NULL)
144+
{
145+
LOG_D("resume thread:%s\n", thread->parent.name);
146+
}
144147

145148
return thread;
146149
}

0 commit comments

Comments
 (0)