Skip to content

system/nxinit: skip actions without commands - #3838

Merged
xiaoxiang781216 merged 2 commits into
apache:masterfrom
JianyuWang0623:mars406-nxinit-empty-action
Oct 13, 2026
Merged

xiaoxiang781216 merged 2 commits into
apache:masterfrom
JianyuWang0623:mars406-nxinit-empty-action

Conversation

@JianyuWang0623

Copy link
Copy Markdown
Contributor

Note: Please adhere to Contributing Guidelines.

Summary

An on section in the rc file can end up with no commands: the section line is
accepted on its own, and a build that runs the rc file through the C
preprocessor can have every command inside a section compiled out. add_ready()
queues such an action anyway, and init_action_run_command() then takes the head
of its empty command list, which list_peek_head_type() reports as NULL, and
dereferences it, so init dies at boot.

Skip actions that have no commands. A cmocka regression test follows.

Impact

An rc file containing an empty on section no longer crashes init at boot; the
section is simply never queued. Nothing else changes: no new Kconfig symbol, no
new dependency, and the test code builds only under the existing
CONFIG_SYSTEM_NXINIT_TEST.

Testing

Host Ubuntu 22.04.5 x86_64, gcc 13.4.0; target sim:nsh, nuttx at 284d4d4e,
nuttx-apps at 27ecdd7.

On top of sim:nsh:

CONFIG_EXPERIMENTAL=y
CONFIG_LIBC_EXECFUNCS=y
CONFIG_SCHED_CHILD_STATUS=y
CONFIG_SYSTEM_NXINIT=y
CONFIG_ALLOW_MIT_COMPONENTS=y
CONFIG_LIBC_REGEX=y
CONFIG_TESTING_CMOCKA=y
CONFIG_SYSTEM_NXINIT_TEST=y

Before:

[  FAILED  ] test_nxinit_action_empty_skipped

and with the test's ready-queue assertion dropped so that
init_action_run_command() is reached:

timeout: the monitored command dumped core

After:

[==========] nxinit_tests: 20 test(s) run.
[  PASSED  ] 20 test(s).

chengkai15 and others added 2 commits October 11, 2026 19:27
An "on" section can end up with an empty command list: the section line
is accepted on its own, and a board whose init.rc goes through the C
preprocessor can have every command inside the section compiled out.
add_ready() queued such an action anyway, and init_action_run_command()
then took the head of its empty command list, which
list_peek_head_type() reports as NULL, and dereferenced it.

Do not queue an action that has no commands.

Assisted-by: Kiro:claude-opus-5
Signed-off-by: Kai Cheng <chengkai@xiaomi.com>
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>
Parse an "on" section with no command under it, trigger its event, and
check that it never reaches the ready queue and that
init_action_run_command() reports INT_MAX instead of taking the head of
an empty command list.

Without the preceding fix this test fails at the ready-queue assertion,
and removing that assertion so the run path is reached crashes on a NULL
dereference.

Assisted-by: Kiro:claude-opus-5
Signed-off-by: wangjianyu3 <wangjianyu3@xiaomi.com>

@cederom cederom left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch thank you @JianyuWang0623 :-)

@JianyuWang0623
JianyuWang0623 marked this pull request as ready for review October 12, 2026 10:32
@xiaoxiang781216
xiaoxiang781216 merged commit fb8bb05 into apache:master Oct 13, 2026
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants