[kernel][ipc] Fix timeout wakeup ownership race

src/ipc.c

@@ -140,7 +140,10 @@ struct rt_thread *rt_susp_list_dequeue(rt_list_t *susp_list, rt_err_t thread_err
     }
     rt_sched_unlock(slvl);
 
-    LOG_D("resume thread:%s\n", thread->parent.name);
+    if (thread)
+    {
+        LOG_D("resume thread:%s\n", thread->parent.name);
+    }
 
     return thread;
 }
@@ -713,10 +716,9 @@ rt_err_t rt_sem_release(rt_sem_t sem)
           sem->parent.parent.name,
           sem->value);
 
-    if (!rt_list_isempty(&sem->parent.suspend_thread))
+    if (!rt_list_isempty(&sem->parent.suspend_thread) &&
+        rt_susp_list_dequeue(&(sem->parent.suspend_thread), RT_EOK) != RT_NULL)
     {
-        /* resume the suspended thread */
-        rt_susp_list_dequeue(&(sem->parent.suspend_thread), RT_EOK);
         need_schedule = RT_TRUE;
     }
     else
@@ -2053,16 +2055,20 @@ rt_err_t rt_event_send(rt_event_t event, rt_uint32_t set)
             /* condition is satisfied, resume thread */
             if (status == RT_EOK)
             {
-                /* clear event */
-                if (thread->event_info & RT_EVENT_FLAG_CLEAR)
-                    need_clear_set |= thread->event_set;
+                status = rt_sched_thread_ready(thread);
+                if (status == RT_EOK)
+                {
+                    /* clear event */
+                    if (thread->event_info & RT_EVENT_FLAG_CLEAR)
+                    {
+                        need_clear_set |= thread->event_set;
+                    }
 
-                /* resume thread, and thread list breaks out */
-                rt_sched_thread_ready(thread);
-                thread->error = RT_EOK;
+                    thread->error = RT_EOK;
 
-                /* need do a scheduling */
-                need_schedule = RT_TRUE;
+                    /* need do a scheduling */
+                    need_schedule = RT_TRUE;
+                }
             }
         }
         if (need_clear_set)

src/scheduler_comm.c

@@ -81,8 +81,11 @@ rt_err_t rt_sched_thread_timer_stop(struct rt_thread *thread)
     {
         error = rt_timer_stop(&thread->thread_timer);
 
-        /* mask out timer flag no matter stop success or not */
-        RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+        /* A failed stop means the timeout callback owns the thread timer. */
+        if (error == RT_EOK)
+        {
+            RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+        }
     }
     else
     {

src/thread.c

@@ -162,6 +162,9 @@ static void _thread_timeout(void *parameter)
      */
     RT_ASSERT(rt_sched_thread_is_suspended(thread));
 
+    /* The timeout callback now owns this thread timer. */
+    RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+
     /* set error number */
     thread->error = -RT_ETIMEOUT;
 

src/utest/SConscript

@@ -60,6 +60,7 @@ if GetDepend(['RT_UTEST_MEMPOOL']):
 
 # Stressful testcase for scheduler (MP/UP)
 if GetDepend(['RT_UTEST_SCHEDULER']):
+    src += ['sched_timeout_race_tc.c']
     src += ['sched_timed_sem_tc.c']
     src += ['sched_timed_mtx_tc.c']
     src += ['sched_mtx_tc.c']