NULL call to _Workspace_Free() via _Objects_Extend_information at startup

[Joel Sherrill]

On 02/28/2011 05:39 PM, Chris Johns wrote:
> On 1/03/11 10:33 AM, Peter Dufault wrote:
>> Does anyone recognize what I might have done to get in this mess?
> Yes I do and I am currently working on a patch. It is also happening on
> the sis BSP in the sparc simulator when run on MacOS.
>
> Could you please raise a PR and assign it to me ?
>
> This looks like an issue on 4.10 as well so a .1 release is not far away.
>
If you can get a NULL pointer to _Heap_Free, then 4.10 is impacted.
But the code path that trips this is new in 4.11 and recent.  It shouldn't
be easy/possible to trip on 4.10 (or ?) but the fix will go in anyway.

This all started when I changed a bunch of "if p!= null workspace_free(p)"
instances into "workspace_free(p)" with a NULL check in Workspace_Free.
Then Sebastian noticed that the NULL check in Workspace_Free was
redundant with checks in Heap_Free.  Unfortunately, when you actually
pass a NULL into Heap_Free, it does math on the pointer and dereferences
it in the protection checks before it validates it.  Chris and I were
chatting about this not even an hour ago.

The fix is fairly straight-forward but Chris needs to review the code
for other possible places something similar is being done.  The code
is:

   _Heap_Protection_block_check( heap, block );

   if ( !_Heap_Is_block_in_heap( heap, block ) ) {
     return false;
   }

It should be

   if ( !_Heap_Is_block_in_heap( heap, block ) ) {
     return false;
   }
_Heap_Protection_block_check( heap, block );

I am sorry you hit this.  Very good/bad timing. :)
> Chris
> _______________________________________________
> rtems-users mailing list
> rtems-users at rtems.org
> http://www.rtems.org/mailman/listinfo/rtems-users


-- 
Joel Sherrill, Ph.D.             Director of Research&  Development
joel.sherrill at OARcorp.com        On-Line Applications Research
Ask me about RTEMS: a free RTOS  Huntsville AL 35805
    Support Available             (256) 722-9985