Race condition in CTimer::PollKernelTimers

[renebarto]

Hi Rene,

I'm continuing my venture on Circle. I Worked on the KY040 rotary switch, and found that, next to issues with the device itself, it causes a race condition.
When two timers are present, and the first one is deleted in a callback of PollKernelTimers due to a CancelKernelTimer call, the ptr list changes, and then the next pointer which was saved, is no longer correct.
I changed this such that after PollKernelTimers reclaims the spinlock, we start at the beginning of the list again. This way the list is correctly pointed to again

void CTimer::PollKernelTimers (void)
{
m_KernelTimerSpinLock.Acquire ();

    TPtrListElement *pElement = m_KernelTimerList.GetFirst ();
    while (pElement != 0)
    {
            TKernelTimer *pTimer = (TKernelTimer *) m_KernelTimerList.GetPtr (pElement);
            assert (pTimer != 0);
            assert (pTimer->m_nMagic == KERNEL_TIMER_MAGIC);

            if ((int) (pTimer->m_nElapsesAt-m_nTicks) > 0)
            {
                    break;
            }

            // Remove: TPtrListElement *pNextElement = m_KernelTimerList.GetNext (pElement);
            m_KernelTimerList.Remove (pElement);
            // Remove: pElement = pNextElement;

            m_KernelTimerSpinLock.Release ();

            TKernelTimerHandler *pHandler = pTimer->m_pHandler;
            assert (pHandler != 0);
            (*pHandler) ((TKernelTimerHandle) pTimer, pTimer->m_pParam, pTimer->m_pContext);

#ifndef NDEBUG
pTimer->m_nMagic = 0;
#endif
delete pTimer;

            m_KernelTimerSpinLock.Acquire ();
            // Add the line below
            pElement = m_KernelTimerList.GetFirst ();
    }

    m_KernelTimerSpinLock.Release ();

}

I hope this is suffciently clear.

Thanks again, regards,

Rene Barto

[rsta2]

Hi Rene, yes, that's an issue. I fixed it on the develop branch. The KY040 was the only place in Circle, where this could happen, because CTimer::CancelKernelTimer() is only there used from a timer handler. Thanks for reporting!

[rsta2]

This fix is in Circle 46.

[renebarto]

Thanks Rene Met vriendelijke groet / Kind regards, Rene Barto Op wo 28 feb. 2024 09:40 schreef Rene Stange ***@***.***>:

…

This fix is in Circle 46. — Reply to this email directly, view it on GitHub <#404 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQY5NMTEMMWR3POS2MVXWTYV3UQXAVCNFSM6AAAAAA57RBNJ6VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DMMJVGI2DQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>