#3829 closed defect (fixed)

4.10: PIP Corruption

Reported by: Gedare Bloom Owned by: Gedare Bloom
Priority: normal Milestone: 4.10.3
Component: admin Version: 4.10
Severity: blocker Keywords:
Cc: Blocked By:
Blocking:

Description (last modified by Gedare Bloom)

The 4.10 priority inheritance protocol was modified in #3359. This modification was only applied to 4.10, because 4.11 and 5.0 have been changed in other ways to deal with PIP problems in the scheduler/synchronization logic.

A user reports that they encounter memory corruption (unaligned memory or data access exception) while using the modified PIP. The specifics have seemingly been narrowed down to the situation of using a (binary) semaphore with a timeout

    status = rtems_semaphore_create( r_name,
                                     1,

                                     (RTEMS_SIMPLE_BINARY_SEMAPHORE | RTEMS_PRIORITY),

                                     0,

                                     &id);

The simple binary semaphore create in the code snippet does not use priority inheritance protocol (rightly, since using PIP with simple binary semaphore is an error). It would seem that there could be a bug introduced in semaphore interactions for non-PIP semaphores in the modified PIP handling. The bookkeeping for PIP handling should be checked against the code paths for simple binary semaphores.

Relatedly, there does not seem to be any test in rtems-4.10 for rtems_semaphore_obtain() on a simple binary semaphore with a timeout.

Change History (2)

comment:1 Changed on Dec 2, 2019 at 7:58:21 PM by Gedare Bloom

Description: modified (diff)

comment:2 Changed on Jan 3, 2020 at 6:11:27 PM by Gedare Bloom <gedare@…>

Resolution: fixed
Status: assignedclosed

In e3f6d35/rtems:

cpukit/score: avoid NULL and races in priority mutex

The PIP modifications from #3359 introduced new data structures
to track priority inheritance. Prioritized mutexes without PIP
share some of the code paths, and may result in NULL pointer
accesses. This patch checks for NULL, and also adds ISR critical
sections to an uncovered corner case during thread restarts.

Closes #3829.

Note: See TracTickets for help on using tickets.