<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style="--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style="font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";">
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.rtems.org/TheSamPrice">Sam Price</a> created a merge request: <a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440">!1440</a>
</p>
<div class="branch">
Project:Branches: TheSamPrice/rtems:test/jffs2-unmount-heap to rtems/rtos/rtems:main
</div>
<div class="author">
Author: Sam Price
</div>
<div class="assignee">
Assignees:
</div>
<div class="reviewer">
Reviewers:
</div>
<div class="md gl-mt-5" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word; margin-top: 1rem;">
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">GCC's -fanalyzer reports a use after free and a double free of root_i on
the JFFS2 unmount path, at cpukit/libfs/src/jffs2/src/fs-rtems.c:1093 and
:1098, where jffs2_iput(root_i) is followed by
rtems_jffs2_free_directory_entries(root_i) and free(root_i).</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Whether that is real turns on the root inode's link count, since
jffs2_iput frees only when i_count reaches zero and i_nlink is also zero,
and the assert above the call fixes i_count at 1. Reading the code does
not settle it.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">fsjffs2empty01 already mounts and unmounts twice, but a passing exit
status does not show the heap is intact: freeing a block twice need not
fault if the block is not reused, and jffs2_iput poisons with 0x5a before
freeing, so a use after free can read plausible garbage.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">This checks the heap instead. Nine mount and unmount cycles, malloc_walk
after each, which fails on the corrupted free lists a double free
produces, and malloc_info compared across cycles, which grows if the free
never happens. Both failure modes are covered, so a pass is evidence
rather than an absence of symptoms.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Measured on riscv/mbv: malloc_walk clean every cycle, and 336 bytes in 4
blocks both after the first cycle and after the ninth.</p>
<p dir="auto" style="color: #3a383f; margin: 0px;" align="initial">Co-Authored-By: Claude Opus 5 (1M context) <a href="mailto:noreply@anthropic.com" style="margin-top: 0px;">noreply@anthropic.com</a>
Signed-off-by: Samuel Price <a href="mailto:thesamprice@gmail.com">thesamprice@gmail.com</a></p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
<a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.rtems.org">gitlab.rtems.org</a>. <a href="https://gitlab.rtems.org/-/sent_notifications/5-bibcguux3b6fxwze3pahm2s1a-1d/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.rtems.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.rtems.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440 at 1787275823
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Merge request","url":"https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440"}}</script>
</p>
</div>
</body>
</html>