From ba79f69477686196da1aa1aca3792e8f6c4e3085 Mon Sep 17 00:00:00 2001
From: "ari.liu" <1486344514@qq.com>
Date: Fri, 21 Aug 2026 11:16:10 +0800
Subject: [kernel][ipc] Fix timeout wakeup ownership race

Keep thread timer ownership when timer stop races with an in-flight timeout callback, and consume IPC resources only after a waiter is resumed successfully.

Complete ownership cleanup in the generic and RT-Smart channel timeout callbacks. Add deterministic scheduler and LWP regressions for Event, Semaphore, Mailbox, Message Queue, sender, and receiver paths.
---
 src/thread.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/thread.c')

diff --git a/src/thread.c b/src/thread.c
index 745e3f774f..0c4a645eac 100644
--- a/src/thread.c
+++ b/src/thread.c
@@ -162,6 +162,9 @@ static void _thread_timeout(void *parameter)
      */
     RT_ASSERT(rt_sched_thread_is_suspended(thread));
 
+    /* The timeout callback now owns this thread timer. */
+    RT_SCHED_CTX(thread).sched_flag_ttmr_set = 0;
+
     /* set error number */
     thread->error = -RT_ETIMEOUT;
 
-- 
cgit v1.3.1