From d8b6f64e29c55a857ca346bd2247cd5aeddaab9e Mon Sep 17 00:00:00 2001 From: Till Straumann Date: Thu, 6 Aug 2009 19:41:57 +0000 Subject: 2009-08-06 Till Straumann * libbsdport/rtems_callout.c: fixed possible race condition. callout_stop() must check again from critical/protected section of code if callout is still on the list/active. Otherwise, the callout-task could have executed and removed the callout between callout_stop() checking the p_prev pointer and entering the critical section. --- bsd_eth_drivers/libbsdport/rtems_callout.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'bsd_eth_drivers/libbsdport') diff --git a/bsd_eth_drivers/libbsdport/rtems_callout.c b/bsd_eth_drivers/libbsdport/rtems_callout.c index de1df83..c041c5b 100644 --- a/bsd_eth_drivers/libbsdport/rtems_callout.c +++ b/bsd_eth_drivers/libbsdport/rtems_callout.c @@ -186,6 +186,11 @@ LIST_KEY_DECL(k); return 0; /* not currently on a list */ LIST_LOCK(k); + /* have to check again */ + if ( ! c->c_pprev ) { + LIST_UNLOCK(k); + return 0; + } /* remove from list */ c_deq(c); rtems_interrupt_disable(l); -- cgit v1.2.3