mirror of
https://github.com/PX4/PX4-Autopilot.git
synced 2026-07-24 15:27:41 +08:00
d828e1b12d
process_add_subscription() (CONFIG_ORB_COMMUNICATOR only) read _data_valid and the topic buffer contents while passing a pointer into _data straight to send_message(), with no synchronization against a concurrent publisher. A publisher's write() memcpy's into _data and sets _data_valid under ATOMIC_ENTER, so the remote-init send can read a torn/partially-updated sample - most clearly for o_queue == 1, where the read slot ((gen - 1) % 1) is exactly the slot being written. This is a pre-existing latent race (the previous px4::atomic<uint8_t*> _data only guarded the pointer, never the bytes) that neither ASan nor TSan can catch because CONFIG_ORB_COMMUNICATOR is not built in those configs. On VOXL2 it runs on the muorb RX thread concurrently with publishers. Snapshot the most recent sample into a temporary buffer under ATOMIC_ENTER, then send it outside the critical section - mirroring copy(). The buffer is allocated before the critical section (it cannot be allocated under ATOMIC_ENTER on NuttX) and send_message() must run outside it anyway, since it can be slow and may call back into DeviceNode. This only affects the rare subscription-add path, not the publish hot path. Signed-off-by: Julian Oes <julian@oes.ch>