score: Close semaphore object before flush

This prevents use of the object after the flush on uni-processor
configurations.

2 files changed, 38 insertions, 26 deletions

diff --git a/cpukit/rtems/src/semdelete.c b/cpukit/rtems/src/semdelete.c
index e3b8058df6..f503cd9712 100644
--- a/cpukit/rtems/src/semdelete.c
+++ b/cpukit/rtems/src/semdelete.c
@@ -48,9 +48,9 @@ rtems_status_code rtems_semaphore_delete(
       attribute_set = the_semaphore->attribute_set;
 #if defined(RTEMS_SMP)
       if ( _Attributes_Is_multiprocessor_resource_sharing( attribute_set ) ) {
-        MRSP_Status mrsp_status = _MRSP_Destroy(
-          &the_semaphore->Core_control.mrsp
-        );
+        MRSP_Status mrsp_status;
+
+        mrsp_status = _MRSP_Can_destroy( &the_semaphore->Core_control.mrsp );
         if ( mrsp_status != MRSP_SUCCESSFUL ) {
           _Objects_Put( &the_semaphore->Object );
           _Objects_Allocator_unlock();
@@ -58,26 +58,14 @@ rtems_status_code rtems_semaphore_delete(
         }
       } else
 #endif
-      if ( !_Attributes_Is_counting_semaphore( attribute_set ) ) {
-        if ( _CORE_mutex_Is_locked( &the_semaphore->Core_control.mutex ) &&
-             !_Attributes_Is_simple_binary_semaphore( attribute_set ) ) {
-          _Objects_Put( &the_semaphore->Object );
-          _Objects_Allocator_unlock();
-          return RTEMS_RESOURCE_IN_USE;
-        }
-        _CORE_mutex_Flush(
-          &the_semaphore->Core_control.mutex,
-          CORE_MUTEX_WAS_DELETED,
-          _Semaphore_MP_Send_object_was_deleted,
-          id
-        );
-        _CORE_mutex_Destroy( &the_semaphore->Core_control.mutex );
-      } else {
-        _CORE_semaphore_Destroy(
-          &the_semaphore->Core_control.semaphore,
-          _Semaphore_MP_Send_object_was_deleted,
-          id
-        );
+      if (
+        !_Attributes_Is_counting_semaphore( attribute_set )
+          && _CORE_mutex_Is_locked( &the_semaphore->Core_control.mutex )
+          && !_Attributes_Is_simple_binary_semaphore( attribute_set )
+      ) {
+        _Objects_Put( &the_semaphore->Object );
+        _Objects_Allocator_unlock();
+        return RTEMS_RESOURCE_IN_USE;
       }
 
       _Objects_Close( &_Semaphore_Information, &the_semaphore->Object );
@@ -96,6 +84,27 @@ rtems_status_code rtems_semaphore_delete(
       }
 #endif
 
+#if defined(RTEMS_SMP)
+      if ( _Attributes_Is_multiprocessor_resource_sharing( attribute_set ) ) {
+        _MRSP_Destroy( &the_semaphore->Core_control.mrsp );
+      } else
+#endif
+      if ( !_Attributes_Is_counting_semaphore( attribute_set ) ) {
+        _CORE_mutex_Flush(
+          &the_semaphore->Core_control.mutex,
+          CORE_MUTEX_WAS_DELETED,
+          _Semaphore_MP_Send_object_was_deleted,
+          id
+        );
+        _CORE_mutex_Destroy( &the_semaphore->Core_control.mutex );
+      } else {
+        _CORE_semaphore_Destroy(
+          &the_semaphore->Core_control.semaphore,
+          _Semaphore_MP_Send_object_was_deleted,
+          id
+        );
+      }
+
       _Objects_Put( &the_semaphore->Object );
       _Semaphore_Free( the_semaphore );
       _Objects_Allocator_unlock();
diff --git a/cpukit/score/include/rtems/score/mrspimpl.h b/cpukit/score/include/rtems/score/mrspimpl.h
index 7638fb5975..1287ad1f50 100644
--- a/cpukit/score/include/rtems/score/mrspimpl.h
+++ b/cpukit/score/include/rtems/score/mrspimpl.h
@@ -398,16 +398,19 @@ RTEMS_INLINE_ROUTINE MRSP_Status _MRSP_Release(
   return MRSP_SUCCESSFUL;
 }
 
-RTEMS_INLINE_ROUTINE MRSP_Status _MRSP_Destroy( MRSP_Control *mrsp )
+RTEMS_INLINE_ROUTINE MRSP_Status _MRSP_Can_destroy( MRSP_Control *mrsp )
 {
   if ( _Resource_Get_owner( &mrsp->Resource ) != NULL ) {
     return MRSP_RESOUCE_IN_USE;
   }
 
+  return MRSP_SUCCESSFUL;
+}
+
+RTEMS_INLINE_ROUTINE void _MRSP_Destroy( MRSP_Control *mrsp )
+{
   _ISR_lock_Destroy( &mrsp->Lock );
   _Workspace_Free( mrsp->ceiling_priorities );
-
-  return MRSP_SUCCESSFUL;
 }
 
 /** @} */