From: Liu Zhi Fu <liuzhifu@espressif.com>
Date: Tue, 24 Jan 2017 12:40:14 +0000 (+0800)
Subject: freertos: fix protection issue in freertos queue event list
X-Git-Tag: v2.0-rc2~59^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0017e75bdad9bb48c2161063793ac423de4a609f;p=esp-idf

freertos: fix protection issue in freertos queue event list

When functions in queue.c calls listLIST_IS_EMPTY() to check queue event list, the queue list is
protected by queue mutex, on the other hand, when xTaskIncrementTick() modify the queue list, the
 queue list is protected by xTaskQueueMutex, this may cause xTaskRemoveFromEventList operate on
the empty queue list and cause problem. This commit is to fix this bug.

may cause
---

diff --git a/components/freertos/tasks.c b/components/freertos/tasks.c
index f885e9c013..02d1842874 100644
--- a/components/freertos/tasks.c
+++ b/components/freertos/tasks.c
@@ -3012,9 +3012,14 @@ BaseType_t xReturn;
 
 	This function assumes that a check has already been made to ensure that
 	pxEventList is not empty. */
-	pxUnblockedTCB = ( TCB_t * ) listGET_OWNER_OF_HEAD_ENTRY( pxEventList );
-	configASSERT( pxUnblockedTCB );
-	( void ) uxListRemove( &( pxUnblockedTCB->xEventListItem ) );
+	if ( ( listLIST_IS_EMPTY( pxEventList ) ) == pdFALSE ) {
+		pxUnblockedTCB = ( TCB_t * ) listGET_OWNER_OF_HEAD_ENTRY( pxEventList );
+		configASSERT( pxUnblockedTCB );
+		( void ) uxListRemove( &( pxUnblockedTCB->xEventListItem ) );
+	} else {
+		taskEXIT_CRITICAL_ISR(&xTaskQueueMutex);
+		return pdFALSE;
+	}
 
 	if( uxSchedulerSuspended[ xPortGetCoreID() ] == ( UBaseType_t ) pdFALSE )
 	{
@@ -3025,9 +3030,7 @@ BaseType_t xReturn;
 	{
 		/* The delayed and ready lists cannot be accessed, so hold this task
 		pending until the scheduler is resumed. */
-		taskENTER_CRITICAL(&xTaskQueueMutex);
 		vListInsertEnd( &( xPendingReadyList[ xPortGetCoreID() ] ), &( pxUnblockedTCB->xEventListItem ) );
-		taskEXIT_CRITICAL(&xTaskQueueMutex);
 	}
 
 	if ( tskCAN_RUN_HERE(pxUnblockedTCB->xCoreID) && pxUnblockedTCB->uxPriority >= pxCurrentTCB[ xPortGetCoreID() ]->uxPriority )