SubscriptionCallback.hpp: Fix race condition in unregisterCb/Poll

Remove _cb_handle before calling unregister_callback, to ensure no one uses the old stale handle before it is cleared.
tiiuae · Oct 9, 2023 · c3a3a83 · c3a3a83
1 parent ed48854
commit c3a3a83
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/platforms/common/uORB/SubscriptionCallback.hpp b/platforms/common/uORB/SubscriptionCallback.hpp
@@ -87,10 +87,10 @@ class SubscriptionCallback : public SubscriptionInterval
 	void unregisterCallback()
 	{
 		if (registered()) {
-			DeviceNode::unregister_callback(_subscription.get_node(), _cb_handle);
+			uorb_cb_handle_t handle = _cb_handle;
+			_cb_handle = UORB_INVALID_CB_HANDLE;
+			DeviceNode::unregister_callback(_subscription.get_node(), handle);
 		}
-
-		_cb_handle = UORB_INVALID_CB_HANDLE;
 	}
 
 	/**
@@ -203,8 +203,9 @@ class SubscriptionPollable : public SubscriptionInterval
 
 	void unregisterPoll()
 	{
-		DeviceNode::unregister_callback(_subscription.get_node(), _cb_handle);
+		uorb_cb_handle_t handle = _cb_handle;
 		_cb_handle = UORB_INVALID_CB_HANDLE;
+		DeviceNode::unregister_callback(_subscription.get_node(), handle);
 	}
 private:
 	uorb_cb_handle_t _cb_handle{UORB_INVALID_CB_HANDLE};