mirror of
https://github.com/PX4/PX4-Autopilot.git
synced 2026-07-24 15:27:41 +08:00
6cc16ff251
* fix(i2c_spi): prevent use-after-free when stopping driver instances module_stop() deleted each instance before unlinking it from the global i2c_spi_module_instances list. The instance *is* the intrusive list node, so removeInstance()/List::remove() then dereferenced the freed node to fix up the links. If another thread reused that heap block in the window, the list got corrupted, sporadically leaving instances linked (a later start reports "already running") or hard-faulting. This regressed in the 2020 array->linked-list refactor: the old array version only nulled an array slot after delete, which was safe. Unlink each instance before freeing it. Also only delete/unlink when the task actually exited: if request_stop_and_wait() times out the work queue may still reference the object, so leave it allocated and listed rather than freeing it. module_stop() now returns -1 when an instance failed to stop. Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com> * Update platforms/common/i2c_spi_buses.cpp * Update platforms/common/i2c_spi_buses.cpp --------- Signed-off-by: Jacob Dahl <dahl.jakejacob@gmail.com>