Possible error in rtems_message_queue_send.

[Wendell Pereira da Silva]

Hi Joel,

 

After a lot of time in test effort of an application (based on RTEMS
4.8.0), I've found a strange behavior in rtems_message_queue_send().

The context is illustrated as follows:

 

lenStatus = rtems_message_queue_send(mqID, &Msg, sizeof(Msg));

if (lenStatus != RTEMS_SUCCESSFUL)

{

    errorRecovery(...);

}

 

This code works fines if mqID identifies a valid message queue object
with enough space. But a bug in my application turned mqID a valid TASK
id. So, it was expected that the errorRecovery() function should be
called but, surprisingly, rtems_message_queue_send() returned
RTEMS_SUCCESSFUL (!).

 

Digging into the RTEMS source from rtems_message_queue_send(), I figured
out that only the index part the object id (the last significant 16-bit)
is used to find the object's entry in the information->local_table
(objectget.c). So, what happened was simply a coincidence: an index of a
Task Object fit to index a Queue Object.

 

What is the right way to fix this? 

 

Solutions:

(1) To put more complexity in rtems_message_queue_send() - hgrrr!. That
is, code for verifying if the ID is really a queue id;

(2) Move such verification code to the application level.

 

 

Att.

 

Wendell Pereira da Silva

COMPSIS Computadores e Sistemas Ind. e Com. Ltda.
Aerospace Systems | [12] 2139-3966 ext. 977 | www.compsis.com.br
<http://www.compsis.com.br/> 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/users/attachments/20090520/1f1fe84a/attachment.html>