mirror of
https://github.com/RIOT-OS/RIOT.git
synced 2024-12-29 04:50:03 +01:00
8a75d8d189
This fixes an alignment issue I encountered in the static version of
the packet buffer.
The bug is caused by a race-condition where a certain order of
operations leads to a chunk being released according to the
byte-alignment of the platform, but overlapping potential space for
a future `_unused_t` struct e.g. (x mark allocated regions):
Future leak of size sizeof(_unused_t) Time
v |
+------------+-----+--------------------+ |
|xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx| +
+------------+-----+--------------------+ |
|
+------------+--+--+--------------------+ |
| |xxxxxxxxxxxxxxxxxxxxxxx| +
+------------+--+--+--------------------+ |
|
+-----+------+--+--+--------------------+ |
|xxxxx| |xxxxxxxxxxxxxxxxxxxxxxx| +
+-----+------+--+--+--------------------+ |
|
+-----+------+-----+---------+----------+ |
|xxxxx| |xxxxxxxxxx| +
+-----+------+-----+---------+----------+ |
|
+-----+------+-----+--------------------+ |
|xxxxx| |xxxxxxxxxxxxxxxxxxxxxxxxxx| +
+-----+------+-----+--------------------+ |
|
+------------+-----+--------------------+ |
|xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx| +
+------------+-----+--------------------+ |
|
+------------+-----+--------------------+ |
|xxxxxxxxxxxxxxxxxx| | +
+------------+-----+--------------------+ |
|
+------------+-----+--------------------+ |
| |xxxxx| | +
+------------+-----+--------------------+ |
v
Sadly, I wasn't able to create a reproducable unittest that show-cases
this corner-case, since I don't understand the order of operations that
cause this one 100%, but the bug is reproducable (but also not
reliably) by sending large (i.e. fragmented) packets to a 6Lo-enabled
host from more than 1 host simultaneously (use `gnrc_pktbuf_cmd` to
check).
By making the size of `_unused_t` the only condition for alignment,
this bug is fixed.
|
||
|---|---|---|
| .. | ||
| analog_util | ||
| arduino | ||
| auto_init | ||
| base64 | ||
| benchmark | ||
| bitfield | ||
| bloom | ||
| can | ||
| cb_mux | ||
| cbor | ||
| checksum | ||
| color | ||
| cpp11-compat | ||
| crypto | ||
| div | ||
| ecc | ||
| embunit | ||
| event | ||
| evtimer | ||
| fmt | ||
| fs | ||
| hashes | ||
| include | ||
| iolist | ||
| isrpipe | ||
| libc/include/sys | ||
| log | ||
| luid | ||
| matstat | ||
| memarray | ||
| mineplex | ||
| net | ||
| newlib_syscalls_default | ||
| od | ||
| oneway-malloc | ||
| phydat | ||
| pipe | ||
| pm_layered | ||
| posix | ||
| ps | ||
| quad_math | ||
| random | ||
| rtt_stdio | ||
| saul_reg | ||
| sema | ||
| seq | ||
| shell | ||
| ssp | ||
| timex | ||
| trickle | ||
| tsrb | ||
| uart_stdio | ||
| ubjson | ||
| universal_address | ||
| uuid | ||
| vfs | ||
| xtimer | ||
| doc.txt | ||
| Makefile | ||
| Makefile.dep | ||
| Makefile.include | ||