Fix: Invalidate MPU object pool entry on timer delete in MPU wrappers v2
diff --git a/portable/Common/mpu_wrappers_v2.c b/portable/Common/mpu_wrappers_v2.c index 70082b8..8f9f092 100644 --- a/portable/Common/mpu_wrappers_v2.c +++ b/portable/Common/mpu_wrappers_v2.c
@@ -3541,6 +3541,15 @@ pxParams->xOptionalValue, pxParams->pxHigherPriorityTaskWoken, pxParams->xTicksToWait ); + + /* Timer deletion is asynchronous - eagerly invalidate the + * object pool entry only if the delete command was successfully + * queued, to prevent stale handle access after the timer daemon + * frees the Timer_t. */ + if( ( xReturn == pdPASS ) && ( pxParams->xCommandID == tmrCOMMAND_DELETE ) ) + { + MPU_SetIndexFreeInKernelObjectPool( CONVERT_TO_INTERNAL_INDEX( lIndex ) ); + } } } }