From f30f0c1938935338605bb0edb77c3c2e90f60822 Mon Sep 17 00:00:00 2001 From: Willy-JL <49810075+Willy-JL@users.noreply.github.com> Date: Sat, 9 Nov 2024 04:42:34 +0000 Subject: [PATCH] Furi: Fix Semaphore atomicity if thread A waiting for acquire(), thread B calls release() halfway through release() code, A would wake up and continue, before B finishes release() this could cause use-after-free if A free()s semaphore after acquire --- furi/core/semaphore.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/furi/core/semaphore.c b/furi/core/semaphore.c index d05b9bf09..513c3a122 100644 --- a/furi/core/semaphore.c +++ b/furi/core/semaphore.c @@ -104,6 +104,8 @@ FuriStatus furi_semaphore_release(FuriSemaphore* instance) { stat = FuriStatusOk; + FURI_CRITICAL_ENTER(); + if(FURI_IS_IRQ_MODE()) { yield = pdFALSE; @@ -123,6 +125,8 @@ FuriStatus furi_semaphore_release(FuriSemaphore* instance) { furi_event_loop_link_notify(&instance->event_loop_link, FuriEventLoopEventIn); } + FURI_CRITICAL_EXIT(); + return stat; }