openqueue_removeAllCreatedBy() can remove packets currently being transmitted

Description

The function openqueue_removeAllCreatedBy() doesn't check who the current owner is before it removes a packet from the queue. If the packet is in the process of being transmitted, owned by COMPONENT_IEEE802154E, then a critical error and reset could occur.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 void openqueue_removeAllCreatedBy(uint8_t creator) { uint8_t i; INTERRUPT_DECLARATION(); DISABLE_INTERRUPTS(); for (i=0;i<QUEUELENGTH;i++){ if (openqueue_vars.queue[i].creator==creator) { openqueue_reset_entry(&(openqueue_vars.queue[i])); } } ENABLE_INTERRUPTS(); } Should be: void openqueue_removeAllCreatedBy(uint8_t creator) { uint8_t i; INTERRUPT_DECLARATION(); DISABLE_INTERRUPTS(); for (i=0;i<QUEUELENGTH;i++){ if (openqueue_vars.queue[i].creator==creator && openqueue_vars.queue[i].owner != COMPONENT_IEEE802154E) { openqueue_vars.stats.numInUse--; openqueue_reset_entry(&(openqueue_vars.queue[i])); } } ENABLE_INTERRUPTS(); }

Environment

None

Status

Assignee

Tengfei Chang

Reporter

john rubis

Labels

None

Story Points

5

Sprint

None

Fix versions

Affects versions

1.22.0

Priority

Critical