What the developer wrote
Authored by Jon Griffiths
usb: set event bits atomically
What changed, and why it matters
This commit fixes a small race condition in how USB event flags are set. Previously, two related event flags could be set in separate, non-atomic calls, meaning an observer might see only one flag update and miss the other. The patch combines the flags and sets them in a single atomic operation, ensuring consistent state. There is no direct evidence this is exploitable for security harm, but race conditions in event handling can theoretically lead to inconsistent USB host state.
Treat as a low-risk hardening fix. Review whether any code path depends on both HOST_NO_CLIENT and HOST_ALL_FREE being observed together, and consider backporting to stable branches if USB reliability is critical. No immediate security response appears necessary based solely on this diff.
Security signals we found
Race condition in event flag updates
Non-atomic multi-bit event group update replaced with atomic single call
USB host library event handling hardening
Evidence from the diff
In usb_host_lib_events(), the code previously called xEventGroupSetBits() separately for HOST_NO_CLIENT and HOST_ALL_FREE. Because each set is atomic individually but the pair is not, a task reading usb_flags between the two calls could observe an intermediate state. The patch accumulates the bits into a local EventBits_t variable and calls xEventGroupSetBits() once, making the combined update atomic. This is a correctness/hardening fix for a FreeRTOS event-group race.
Changed components
main/usbhmsc/usbhmsc.cUSB Mass Storage Host (usbhmsc) event handlingFreeRTOS event group usb_flagsInspect captured patch +6 / −2
diff --git a/main/usbhmsc/usbhmsc.c b/main/usbhmsc/usbhmsc.c
index 14f9d8c..d4efa7a 100644
--- a/main/usbhmsc/usbhmsc.c
+++ b/main/usbhmsc/usbhmsc.c
@@ -99,11 +99,15 @@ static void usb_host_lib_events(const uint32_t timeout)
JADE_ERROR_CHECK(err);
+ EventBits_t event = 0;
if (event_flags & USB_HOST_LIB_EVENT_FLAGS_NO_CLIENTS) {
- xEventGroupSetBits(usb_flags, HOST_NO_CLIENT);
+ event |= HOST_NO_CLIENT;
}
if (event_flags & USB_HOST_LIB_EVENT_FLAGS_ALL_FREE) {
- xEventGroupSetBits(usb_flags, HOST_ALL_FREE);
+ event |= HOST_ALL_FREE;
+ }
+ if (event) {
+ xEventGroupSetBits(usb_flags, event);
}
}
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.