From 2d43eebcab979fb58a5b48ad899c8ef28868872e Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Fri, 4 Aug 2023 13:53:58 -0400 Subject: [PATCH] kernel: Store "next" pointer before notifying B_EVENT_INVALID. Once B_EVENT_INVALID has been set, the select routine is free to delete the select_info at any time. We therefore cannot access the "next" pointer after notify_select_events returns. May fix a KDL seen by trungnt2910. --- src/system/kernel/events/wait_for_objects.cpp | 3 ++- src/system/kernel/fs/fd.cpp | 3 ++- src/system/kernel/thread.cpp | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/system/kernel/events/wait_for_objects.cpp b/src/system/kernel/events/wait_for_objects.cpp index 85c43b75b6..40bce55008 100644 --- a/src/system/kernel/events/wait_for_objects.cpp +++ b/src/system/kernel/events/wait_for_objects.cpp @@ -745,8 +745,9 @@ notify_select_events_list(select_info* list, uint16 events) { struct select_info* info = list; while (info != NULL) { + select_info* next = info->next; notify_select_events(info, events); - info = info->next; + info = next; } } diff --git a/src/system/kernel/fs/fd.cpp b/src/system/kernel/fs/fd.cpp index c026fb4c28..880fb15d92 100644 --- a/src/system/kernel/fs/fd.cpp +++ b/src/system/kernel/fs/fd.cpp @@ -556,8 +556,9 @@ deselect_select_infos(file_descriptor* descriptor, select_info* infos, } } + select_info* next = info->next; notify_select_events(info, B_EVENT_INVALID); - info = info->next; + info = next; if (putSyncObjects) put_select_sync(sync); diff --git a/src/system/kernel/thread.cpp b/src/system/kernel/thread.cpp index 262fd07b74..475c2d3bb6 100644 --- a/src/system/kernel/thread.cpp +++ b/src/system/kernel/thread.cpp @@ -2242,9 +2242,10 @@ thread_exit(void) while (info != NULL) { select_sync* sync = info->sync; + select_info* next = info->next; notify_select_events(info, B_EVENT_INVALID); - info = info->next; put_select_sync(sync); + info = next; } // notify listeners