Skip to content

Commit 5fe82aa

Browse files
authored
[Sponsored by CubePilot] Try to fix potential mavlink segfaults on USB disconnect (#26083)
* mavlink: fix potential use-after-free If a mavlink instance is force stopped, the main thread might be out of scope and the receiver thread would be doing a use-after-free. Instead the receiver thread needs to check its own _should_exit flag. * mavlink: protect shared data by mutex in dtor I'm not sure if this potentially fixes any of the segfaults we have seen on stopping mavlink instances but it potentially could matter if the mavlink_receiver thread is killed after a timeout and tries to send any messages as a zombie.
1 parent b92d21b commit 5fe82aa

File tree

2 files changed

+5
-2
lines changed

2 files changed

+5
-2
lines changed

src/modules/mavlink/mavlink_main.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,10 @@ Mavlink::~Mavlink()
163163
}
164164

165165
if (_instance_id >= 0) {
166-
mavlink_module_instances[_instance_id] = nullptr;
166+
{
167+
LockGuard lg{mavlink_module_mutex};
168+
mavlink_module_instances[_instance_id] = nullptr;
169+
}
167170
mavlink_instance_count.fetch_sub(1);
168171
}
169172

src/modules/mavlink/mavlink_receiver.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3160,7 +3160,7 @@ MavlinkReceiver::run()
31603160
ssize_t nread = 0;
31613161
hrt_abstime last_send_update = 0;
31623162

3163-
while (!_mavlink.should_exit()) {
3163+
while (!_should_exit.load()) {
31643164

31653165
// check for parameter updates
31663166
if (_parameter_update_sub.updated()) {

0 commit comments

Comments
 (0)