uORBDeviceNode: Fix race with _unregister_callback

In case the callback has bee posted by DeviceNode::Write, but not yet handled by the callback thread, we must cancel the posts after removing the cb from the list of callbacks. Signed-off-by: Jukka Laitinen <[email protected]>
tiiuae · Jan 25, 2024 · f92eec4 · f92eec4
1 parent 92dee64
commit f92eec4
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/platforms/common/uORB/uORBDeviceNode.cpp b/platforms/common/uORB/uORBDeviceNode.cpp
@@ -917,6 +917,12 @@ uORB::DeviceNode::_unregister_callback(uorb_cb_handle_t &cb_handle)
 		PX4_ERR("unregister fail\n");
 
 	} else {
+		EventWaitItem *item = callbacks.peek(cb_handle);
+
+		while (__atomic_fetch_sub(&item->cb_triggered, 1, __ATOMIC_SEQ_CST) >= 0) {
+			Manager::lockThread(item->lock);
+		}
+
 		callbacks.push_free(cb_handle);
 		cb_handle = UORB_INVALID_CB_HANDLE;
 	}