[kernel][ipc] Fix timeout wakeup ownership race

src/ipc.c

@@ -104,6 +104,7 @@ rt_inline rt_err_t _ipc_object_init(struct rt_ipc_object *ipc)
  */
 struct rt_thread *rt_susp_list_dequeue(rt_list_t *susp_list, rt_err_t thread_error)
 {
+    rt_list_t *node;
     rt_sched_lock_level_t slvl;
     rt_thread_t thread;
     rt_err_t error;
@@ -112,35 +113,39 @@ struct rt_thread *rt_susp_list_dequeue(rt_list_t *susp_list, rt_err_t thread_err
     RT_ASSERT(susp_list != RT_NULL);
 
     rt_sched_lock(&slvl);
-    if (!rt_list_isempty(susp_list))
+    thread = RT_NULL;
+    node = susp_list->next;
+    while (node != susp_list)
     {
-        thread = RT_THREAD_LIST_NODE_ENTRY(susp_list->next);
+        thread = RT_THREAD_LIST_NODE_ENTRY(node);
+        node = node->next;
         error = rt_sched_thread_ready(thread);
 
         if (error)
         {
             LOG_D("%s [error:%d] failed to resume thread:%p from suspended list",
                   __func__, error, thread);
 
+            /* The timeout callback owns this waiter. Try the next one. */
             thread = RT_NULL;
+            continue;
         }
-        else
+
+        /* thread error should not be a negative value */
+        if (thread_error >= 0)
         {
-            /* thread error should not be a negative value */
-            if (thread_error >= 0)
-            {
-                /* set thread error code to notified resuming thread */
-                thread->error = thread_error;
-            }
+            /* set thread error code to notified resuming thread */
+            thread->error = thread_error;
         }
-    }
-    else
-    {
-        thread = RT_NULL;
+
+        break;
     }
     rt_sched_unlock(slvl);
 
-    LOG_D("resume thread:%s\n", thread->parent.name);
+    if (thread)
+    {
+        LOG_D("resume thread:%s\n", thread->parent.name);
+    }
 
     return thread;
 }
@@ -713,10 +718,9 @@ rt_err_t rt_sem_release(rt_sem_t sem)
           sem->parent.parent.name,
           sem->value);
 
-    if (!rt_list_isempty(&sem->parent.suspend_thread))
+    if (!rt_list_isempty(&sem->parent.suspend_thread) &&
+        rt_susp_list_dequeue(&(sem->parent.suspend_thread), RT_EOK) != RT_NULL)
     {
-        /* resume the suspended thread */
-        rt_susp_list_dequeue(&(sem->parent.suspend_thread), RT_EOK);
         need_schedule = RT_TRUE;
     }
     else
@@ -2033,16 +2037,18 @@ rt_err_t rt_event_send(rt_event_t event, rt_uint32_t set)
             /* condition is satisfied, resume thread */
             if (status == RT_EOK)
             {
-                /* clear event */
-                if (thread->event_info & RT_EVENT_FLAG_CLEAR)
-                    need_clear_set |= thread->event_set;
+                status = rt_sched_thread_ready(thread);
+                if (status == RT_EOK)
+                {
+                    /* clear event */
+                    if (thread->event_info & RT_EVENT_FLAG_CLEAR)
+                        need_clear_set |= thread->event_set;
 
-                /* resume thread, and thread list breaks out */
-                rt_sched_thread_ready(thread);
-                thread->error = RT_EOK;
+                    thread->error = RT_EOK;
 
-                /* need do a scheduling */
-                need_schedule = RT_TRUE;
+                    /* need do a scheduling */
+                    need_schedule = RT_TRUE;
+                }
             }
         }
         if (need_clear_set)

src/scheduler_comm.c

@@ -81,8 +81,11 @@ rt_err_t rt_sched_thread_timer_stop(struct rt_thread *thread)
     {
         error = rt_timer_stop(&thread->thread_timer);
 
-        /* mask out timer flag no matter stop success or not */
-        RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+        /* A failed stop means the timeout callback owns the thread timer. */
+        if (error == RT_EOK)
+        {
+            RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+        }
     }
     else
     {

src/thread.c

@@ -162,6 +162,9 @@ static void _thread_timeout(void *parameter)
      */
     RT_ASSERT(rt_sched_thread_is_suspended(thread));
 
+    /* The timeout callback now owns this thread timer. */
+    RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+
     /* set error number */
     thread->error = -RT_ETIMEOUT;
 

src/utest/SConscript

@@ -60,6 +60,7 @@ if GetDepend(['RT_UTEST_MEMPOOL']):
 
 # Stressful testcase for scheduler (MP/UP)
 if GetDepend(['RT_UTEST_SCHEDULER']):
+    src += ['sched_timeout_race_tc.c']
     src += ['sched_timed_sem_tc.c']
     src += ['sched_timed_mtx_tc.c']
     src += ['sched_mtx_tc.c']