From c2287ba2cff59a50848151833404bce0e3cf0a70 Mon Sep 17 00:00:00 2001 From: Sebastian Huber Date: Tue, 10 Mar 2020 17:07:19 +0100 Subject: libio: Robust file descriptor reference counting There was a race conditon in the reference counting of file descriptors during a close() operation. After the call to the close handler, the rtems_libio_free() function cleared the flags to zero. However, at this point in time there may still exist some holders of the file descriptor. With RTEMS_DEBUG enabled this could lead to failed assertions in rtems_libio_iop_drop(). Change the code to use only atomic read-modify-write operations on the rtems_libio_iop::flags. --- cpukit/libcsupport/src/termios.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'cpukit/libcsupport/src/termios.c') diff --git a/cpukit/libcsupport/src/termios.c b/cpukit/libcsupport/src/termios.c index b10a4ad774..81518f36de 100644 --- a/cpukit/libcsupport/src/termios.c +++ b/cpukit/libcsupport/src/termios.c @@ -2110,7 +2110,7 @@ rtems_termios_imfs_open (rtems_libio_t *iop, memset (&args, 0, sizeof (args)); args.iop = iop; - args.flags = iop->flags; + args.flags = rtems_libio_iop_flags (iop); args.mode = mode; rtems_termios_obtain (); @@ -2162,7 +2162,7 @@ rtems_termios_imfs_read (rtems_libio_t *iop, void *buffer, size_t count) args.iop = iop; args.buffer = buffer; args.count = count; - args.flags = iop->flags; + args.flags = rtems_libio_iop_flags (iop); sc = rtems_termios_linesw[tty->t_line].l_read (tty, &args); tty->tty_rcvwakeup = false; @@ -2202,7 +2202,7 @@ rtems_termios_imfs_write (rtems_libio_t *iop, const void *buffer, size_t count) args.iop = iop; args.buffer = RTEMS_DECONST (void *, buffer); args.count = count; - args.flags = iop->flags; + args.flags = rtems_libio_iop_flags (iop); sc = rtems_termios_linesw[tty->t_line].l_write (tty, &args); rtems_mutex_unlock (&tty->osem); -- cgit v1.2.3