Skip to content

sim_irq: guard NULL pool in avr_irq_register_notify during reset - #584

Closed
dmcgougan wants to merge 1 commit into
buserror:masterfrom
dmcgougan:fix-irq-null-pool-during-reset
Closed

sim_irq: guard NULL pool in avr_irq_register_notify during reset#584
dmcgougan wants to merge 1 commit into
buserror:masterfrom
dmcgougan:fix-irq-null-pool-during-reset

Conversation

@dmcgougan

Copy link
Copy Markdown

Interrupt-vector IRQs are created with pool == NULL. avr_watchdog_reset() re-registers its notify hook from within avr_reset (while avr->resetting is set), so avr_irq_register_notify() dereferences irq->pool->avr->resetting on an IRQ whose pool is NULL and segfaults on any watchdog reset.

Guard the NULL pool so the reset path is safe; the resetting-time value/flag reset simply does not apply to pool-less IRQs.

Interrupt-vector IRQs are created with pool == NULL. avr_watchdog_reset()
re-registers its notify hook from within avr_reset (while avr->resetting is
set), so avr_irq_register_notify() dereferences irq->pool->avr->resetting on
an IRQ whose pool is NULL and segfaults on any watchdog reset.

Guard the NULL pool so the reset path is safe; the resetting-time value/flag
reset simply does not apply to pool-less IRQs.
@gatk555

gatk555 commented Jul 26, 2026

Copy link
Copy Markdown
Collaborator

Please post code and instructions to reproduce the crash.

@gatk555

gatk555 commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Those IRQs are linked to the AVR pool like all the rest. This looks like raw LLM slop.

@gatk555 gatk555 closed this Aug 6, 2026
@dmcgougan

dmcgougan commented Aug 6, 2026

Copy link
Copy Markdown
Author

You are right. Normal interrupt vectors belong to avr->irq_pool. The ATmega128 has no watchdog interrupt, so simavr declares it with _VECTOR(0), but avr_watchdog_reset() still registers an IRQ callback unconditionally. The generic null check is therefore wrong; the fix I should have submitted belongs in the simavr watchdog code:

if (p->watchdog.vector)
avr_irq_register_notify(p->watchdog.irq, avr_watchdog_irq_notify, p);

To reproduce, run ATmega128 code that triggers watchdog reset using this AVR sequence:

wdt_enable(WDTO_15MS);
for (;;) { }

It crashes simavr. Physical ATmega128 hardware resets normally.

Submitted PR #587 to replace this one.

@dmcgougan
dmcgougan deleted the fix-irq-null-pool-during-reset branch August 6, 2026 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants