#1964 closed defect (fixed)

_Chain_Is_first/last overshoot

Reported by: Gedare Bloom Owned by: Joel Sherrill
Priority: normal Milestone: 4.11
Component: score Version: 4.10
Severity: normal Keywords:
Cc: sebastian.huber@…, seb@… Blocked By:

Description (last modified by Gedare Bloom)

A user reported a possible problem with the implementation of the _Chain_Is_first/last functions:

Subject: [Milkymist-devel] [PATCH, tentative] RTEMS: _Chain_Is_first/last overshoot
Date: Wed, 9 Nov 2011 16:53:53 -0300
From: Werner Almesberger <werner@…>
Reply-To: Milkymist One, Milkymist SoC and Flickernoise developers' list <devel@…>
To: Milkymist One, Milkymist SoC and Flickernoise developers' list <devel@…>

Doubly-linked lists ("chains") in RTEMS have a "control" block that
looks like the next/prev link pair in an element. The list elements
link both ways to this control block.

_Chain_Is_first and _Chain_Is_last only probed if the link to the
next element - which would be the control block - is non-NULL.
Telling by the function description and given that there are already
functions called _Chain_Is_head and _Chain_Is_tail (which could be
simplified), this is probably not the intended behaviour.

This also affects the aliases rtems_chain_is_first and

These functions are not used a lot and I haven't seen any immediate
effect on M1 after changing them, so I can't say whether this patch
may unearth other problems.

  • Werner

Attachments (3)

spchain.diff (1.8 KB) - added by Gedare Bloom on 11/12/11 at 21:59:00.
Patch demonstrating bug
rtems-cvs.diff (676 bytes) - added by Gedare Bloom on 11/12/11 at 22:00:25.
Patch fixing bug.
sapichain.diff (657 bytes) - added by Gedare Bloom on 11/14/11 at 15:23:16.
check for null dereference in rtems chain api

Download all attachments as: .zip

Change History (11)

Changed on 11/12/11 at 21:59:00 by Gedare Bloom

Attachment: spchain.diff added

Patch demonstrating bug

Changed on 11/12/11 at 22:00:25 by Gedare Bloom

Attachment: rtems-cvs.diff added

Patch fixing bug.

Changed on 11/14/11 at 15:23:16 by Gedare Bloom

Attachment: sapichain.diff added

check for null dereference in rtems chain api

comment:1 Changed on 11/14/11 at 15:35:36 by Sebastian Huber

Cc: Sebastian Huber added

comment:2 Changed on 11/14/11 at 16:23:53 by Gedare Bloom

attachments.isobsolete: 01

comment:3 Changed on 11/25/11 at 14:43:25 by seb

Cc: seb added

comment:4 Changed on 11/26/11 at 17:12:42 by Gedare Bloom

Status: newassigned

comment:5 Changed on 11/27/11 at 15:09:41 by Joel Sherrill

Resolution: fixed
Status: assignedclosed


comment:6 Changed on 11/24/14 at 18:58:28 by Gedare Bloom

Version: HEAD4.11

Replace Version=HEAD with Version=4.11 for the tickets with Milestone >= 4.11

comment:7 Changed on 01/10/18 at 14:36:07 by Gedare Bloom

Description: modified (diff)
Version: 4.114.10

I ran over this on 4.10.2 also. I will plan to fix it on the 4.10 branch pending 4.10.3.

comment:8 Changed on 01/10/18 at 14:49:05 by Gedare Bloom <gedare@…>

Last edited on 03/23/18 at 14:47:23 by Gedare Bloom (previous) (diff)
Note: See TracTickets for help on using tickets.