Skip to content

ipc: userspace: don't fault when removing an already-sent IPC message #11157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kv2019i wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ipc: userspace: don't fault when removing an already-sent IPC message #11157

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion src/ipc/ipc-common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,7 +362,17 @@ void z_vrfy_ipc_msg_list_remove(struct ipc_msg *msg)
break;
}
}
K_OOPS(K_SYSCALL_VERIFY(found));

/*
* ipc_msg_list_remove() is normally called from ipc_msg_free() to drop
* a message that may or may not still be queued. A message that has
* already been sent (or was never queued) has a self-linked, empty list
* node, so removing it via list_item_del() is a harmless no-op that only
* touches &msg->list, which was already validated above. Only reject a
* non-empty node that is not on ipc->msg_list, i.e. one whose list
* pointers would make list_item_del() corrupt unrelated memory.
*/
K_OOPS(K_SYSCALL_VERIFY(found || list_is_empty(&msg->list)));

@jsarha jsarha Sep 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, now that I think about it, Copilot actually has a point here, but I would not fix it the way Copilot suggests, but I would simply add:

if (list_is_empty(&msg->list))
	return;

after the search loop, and have the original K_OOPS(K_SYSCALL_VERIFY(found)); after that.

z_impl_ipc_msg_list_remove(msg);
}
#include <zephyr/syscalls/ipc_msg_list_remove_mrsh.c>
Expand Down
Loading