Event Groups: snapshot xEventGroupSetBits returning value while in vTaskSuspendAll (FreeRTOS#1143)

Event Groups: snapshot xEventGroupSetBits returning value while in
vTaskSuspendAll. Fixes uxEventBits dereference after event group
deleted by higher priority thread.

Author: skotopes

event_groups.c

@@ -551,7 +551,7 @@
         ListItem_t * pxNext;
         ListItem_t const * pxListEnd;
         List_t const * pxList;
-        EventBits_t uxBitsToClear = 0, uxBitsWaitedFor, uxControlBits;
+        EventBits_t uxBitsToClear = 0, uxBitsWaitedFor, uxControlBits, uxReturnBits;
         EventGroup_t * pxEventBits = xEventGroup;
         BaseType_t xMatchFound = pdFALSE;
 
@@ -635,12 +635,15 @@
             /* Clear any bits that matched when the eventCLEAR_EVENTS_ON_EXIT_BIT
              * bit was set in the control word. */
             pxEventBits->uxEventBits &= ~uxBitsToClear;
+
+            /* Snapshot resulting bits. */
+            uxReturnBits = pxEventBits->uxEventBits;
         }
         ( void ) xTaskResumeAll();
 
-        traceRETURN_xEventGroupSetBits( pxEventBits->uxEventBits );
+        traceRETURN_xEventGroupSetBits( uxReturnBits );
 
-        return pxEventBits->uxEventBits;
+        return uxReturnBits;
     }
 /*-----------------------------------------------------------*/
 

include/event_groups.h

@@ -483,14 +483,11 @@ EventBits_t xEventGroupClearBits( EventGroupHandle_t xEventGroup,
  * and bit 0 set uxBitsToSet to 0x09.
  *
  * @return The value of the event group at the time the call to
- * xEventGroupSetBits() returns.  There are two reasons why the returned value
- * might have the bits specified by the uxBitsToSet parameter cleared.  First,
- * if setting a bit results in a task that was waiting for the bit leaving the
- * blocked state then it is possible the bit will be cleared automatically
- * (see the xClearBitOnExit parameter of xEventGroupWaitBits()).  Second, any
- * unblocked (or otherwise Ready state) task that has a priority above that of
- * the task that called xEventGroupSetBits() will execute and may change the
- * event group value before the call to xEventGroupSetBits() returns.
+ * xEventGroupSetBits() returns.  Returned value might have the bits specified
+ * by the uxBitsToSet parameter cleared if setting a bit results in a task
+ * that was waiting for the bit leaving the blocked state then it is possible
+ * the bit will be cleared automatically (see the xClearBitOnExit parameter
+ * of xEventGroupWaitBits()).
  *
  * Example usage:
  * @code{c}