unleashed-firmware/furi
Kris Bahnsen 26da5f564b
furi/core/timer: resolve timer handle use-after-free post deletion (#3431)
When xTimerDelete is called using a dymanic timer handle, the timer
handle should immediately be considered unusable for any operation;
including checking if the timer is still running. Under high system
loads, that memory region may see fast reuse while furi_timer_free
is sleeping between timer active checks. That reuse could result in
memory at that pointer causing the timer active check to return true.

Rework the furi_timer_delete process (in the case of dynamically
allocated callback memory) to stop the timer, wait for it to stop,
free the memory, and then delete the timer. Timers without dynamically
allocated callback memory are just sent a delete command; no need
to stop it first.

Fixes: ff33bc6aea ("Furi: wait for timer wind down in destructor (#1716)")

Signed-off-by: Kris Bahnsen <Kris@KBEmbedded.com>
2024-02-08 16:22:03 +07:00
..
core furi/core/timer: resolve timer handle use-after-free post deletion (#3431) 2024-02-08 16:22:03 +07:00
flipper.c Furi, FuriHal: remove FreeRTOS headers leaks (#3179) 2023-11-01 11:24:11 +04:00
flipper.h Furi: core refactoring and CMSIS removal part 2 (#1410) 2022-07-20 13:56:33 +03:00
furi.c Furi, FuriHal: remove FreeRTOS headers leaks (#3179) 2023-11-01 11:24:11 +04:00
furi.h Furi, FuriHal: remove FreeRTOS headers leaks (#3179) 2023-11-01 11:24:11 +04:00
SConscript fbt: lint fixes (#2008) 2022-11-12 19:03:22 +09:00