[nuttx] branch master updated: usrsock_rpmsg_server: Clear revents for POLLHUP and POLLERR

[xi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 33da959fbc usrsock_rpmsg_server: Clear revents for POLLHUP and POLLERR
33da959fbc is described below

commit 33da959fbc5a1c0b14624375a25488683d347c07
Author: Zhe Weng <we...@xiaomi.com>
AuthorDate: Thu Jul 6 16:32:53 2023 +0800

    usrsock_rpmsg_server: Clear revents for POLLHUP and POLLERR
    
    Note:
    tcp_poll_eventhandler have logic after poll_notify, if we teardown poll
    inside poll callback without clearing revents, use-after-free will
    happen.
    
    Signed-off-by: Zhe Weng <we...@xiaomi.com>
---
 drivers/usrsock/usrsock_rpmsg_server.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usrsock/usrsock_rpmsg_server.c b/drivers/usrsock/usrsock_rpmsg_server.c
index bb12f2119d..5548e1106f 100644
--- a/drivers/usrsock/usrsock_rpmsg_server.c
+++ b/drivers/usrsock/usrsock_rpmsg_server.c
@@ -1082,6 +1082,7 @@ static void usrsock_rpmsg_poll_setup(FAR struct pollfd *pfds,
     }
   else
     {
+      pfds->revents = 0;
       pfds->events = 0;
       ret = psock_poll(psock, pfds, false);
     }
@@ -1142,6 +1143,10 @@ static void usrsock_rpmsg_poll_cb(FAR struct pollfd *pfds)
         {
           events |= USRSOCK_EVENT_RECVFROM_AVAIL;
         }
+
+      /* Clear revents */
+
+      pfds->revents &= ~(POLLHUP | POLLERR);
     }
 
   if (oldevents != pfds->events)