Mirrors_Framework/threadx
1
0
Fork 0
mirror of https://github.com/eclipse-threadx/threadx.git synced 2026-10-06 06:59:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Refused to give back the memory of a live kernel object

A module allocates the control blocks of its kernel objects from the Module
Manager's object pool and can ask for that memory back by address. The manager
released it whatever was in it, including a control block the kernel was still
using. Deallocation is not deletion: the object stays on the created list for its
type, a thread stays wherever it was on the ready or suspension lists and stays
schedulable, and an active timer stays on the timer list. Nothing on those paths
consults a control block ID, so nothing about the memory having been freed stops
the kernel from using it -- a created list walk reads a name pointer out of it and
follows that pointer, a create or delete of another object of the same type writes
through the created links in it, the scheduler switches the stack pointer to the
word at offset 8 of it and pops a saved processor state, and timer expiration
calls the function pointer in it. Meanwhile the byte pool is free to hand those
same bytes to the next allocation, so what the kernel goes on reading as a control
block becomes whatever the next owner of the memory puts there, through ordinary
create services.

The manager now refuses to release memory that holds an object which is still
created, and returns TX_DELETE_ERROR without touching the allocation, the object
or the memory. Deleting the object first is what makes its memory releasable,
which is the sequence the delete dispatchers already follow and the one module
authors are told to follow.

The question is answered from the kernel's created lists, not from the control
block. A control block ID is not evidence that an object is there: an allocation
that was never created can be carrying the value of an ID, and refusing on that
would strand memory a module is entitled to have back. Deallocation is also given
an address and nothing else, so unlike a typed service it cannot be told which
list to search, and each of the eight lists is searched in turn. The search is not
narrowed by the size of the allocation, because that would be sound only if every
object had been created through a size-checked path, and a module running without
memory protection creates objects through no such path -- a queue at the start of a
thread-sized allocation is a case the tests here cover. Each list is searched in
its own interrupts-disabled window, bounded by the count the kernel keeps beside
it, so the longest window is the length of one type's list and a list whose links
have been damaged cannot make the search run on. The whole search is one pass over
the objects the system has created, paid once per object deallocation.

Storage that is not an object is released exactly as before, which is what keeps
cleanup after a create that failed or was abandoned working, and what makes the
release each delete dispatcher performs after a successful delete go through.

The address the request arrives with is now checked before the manager's private
header in front of it is read, rather than partly after. The size of the
allocation comes from that header, so there is nothing to validate a size against
until the header has been read, and the previous order established only where the
header started: a header that began inside the pool and ended past it had its size
word read from outside the pool. That check has moved out of the dispatcher into
_txm_module_manager_param_check_object_for_deallocation, alongside the other
parameter checks the dispatch table uses and where a test can reach it, and it now
also refuses a size that would carry the end of the allocation past the top of the
address space instead of wrapping it, since a wrapped end compares as though the
allocation were inside the pool.

The 301 expectations in the new test drive all eight object types through allocate,
create, a refused deallocation, delete, and a deallocation that succeeds, and
assert after the refusal that nothing reached the pool, that the allocation is
still on the module's list at the head of it, that the control block still carries
its ID and that the object is still live. They cover storage that was never
created, storage carrying nothing but a plausible ID for each of the eight types,
an object at the start of an oversized allocation, every aligned interior offset
of a live object with that object's own ID planted at it, an application-owned
object outside the pool, another module's allocations both live and raw, releasing
the head of a list of several and releasing the same address twice, a type that has
no created list, the bounds on the search against a list longer than its count and
against a count larger than its list for every type, the boundary addresses at both
ends of the pool, a crafted size, and an object pool that was never created.
Removing the refusal fails 43 of them; removing the size wrap guard fails one.

Line and branch coverage of the three new functions and of the changed
_txm_module_manager_object_deallocate is 100%, with one exception that is test
scaffolding rather than product code: the host shim's stand-in for TX_RESTORE has
an underflow guard, and the test asserts that branch is never taken. All 99 tests
pass in each of the five configurations the tree builds with GCC 14.

Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com>

* Removed the object deallocation bounds check superseded by the search

_txm_module_manager_param_check_object_for_deallocation() bounded the private
header in front of a caller's address before the deallocator read it. The
deallocator no longer reads that header: it finds the allocation by searching
the module's own allocation list, which never dereferences the address, so the
bounds check now guards a read that does not happen.

The function, its prototype, its macro and its one call site in the
txm_module_object_deallocate dispatcher are removed, along with the twelve
expectations that covered it and three declarations left unused by their
removal. The search proves more than the check did: the bounds test established
only that the header lay inside the object pool, while the search establishes
that the address is the exact start of one of this module's allocations.

The live object deallocation test holds 289 expectations and passes. Reverting
the live-object guard still fails 51 of them, the same 51 as before the
deletion, so nothing the removed expectations covered was load-bearing. The
full suite passes 108/108 in default_build_coverage, with no warnings.

Assisted-by: Claude Code (Opus 5) <noreply@anthropic.com>
This commit is contained in:
Frédéric Desbiens
2026-09-28 10:13:22 -04:00
committed by GitHub
parent 3276b0efd5
commit 2930618cfe
10 changed files with 2086 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build-all.log
+442
View File
File diff suppressed because it is too large Load Diff
common_modules/module_lib/src/txm_module_object_deallocate.c
+13 -6
View File
@@ -9,6 +9,8 @@
* SPDX-License-Identifier: MIT
**************************************************************************/
// Some portions generated by Claude Code (Opus 5).
/**************************************************************************/
/**************************************************************************/
@@ -36,14 +38,18 @@
* WHAT TO DO: remove any call to txm_module_object_deallocate() from your
* module. The corresponding tx_*_delete() call already handles everything.
*
* RISK: calling txm_module_object_deallocate() on a live kernel object (one
* whose tx_*_delete() has not yet been called) frees the backing pool memory
* while the object is still referenced by the kernel, which is undefined
* behaviour (use-after-free).
* BEHAVIOUR: calling txm_module_object_deallocate() on a live kernel object
* (one whose tx_*_delete() has not yet been called) returns TX_DELETE_ERROR
* and changes nothing. The Module Manager will not release the memory of a
* created object, because the kernel goes on using those bytes as a control
* block after the byte pool has handed them to somebody else. Storage that
* was allocated but never made into an object is still released, so cleaning
* up after a create that failed or was abandoned still works.
*/
#pragma message("txm_module_object_deallocate() is deprecated and must not be used. " \
"Call tx_*_delete() instead; the Module Manager dispatch layer " \
"releases pool memory automatically on success.")
"releases pool memory automatically on success. Deallocating a " \
"live kernel object returns TX_DELETE_ERROR.")
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
@@ -64,7 +70,8 @@
/* */
/* OUTPUT */
/* */
/* status Completion status */
/* status Completion status, TX_DELETE_ERROR*/
/* if a live object is there */
/* */
/* CALLS */
/* */
common_modules/module_manager/inc/txm_module_manager_dispatch.h
+2 -35
View File
@@ -15,6 +15,8 @@
// Some portions generated by Claude Code (Opus 5).
// Some portions generated by Claude Code (Opus 5).
/**************************************************************************/
/**************************************************************************/
@@ -3285,41 +3287,6 @@ static ALIGN_TYPE _txm_module_manager_txm_module_object_deallocate_dispatch(TXM_
{
ALIGN_TYPE return_value;
TXM_MODULE_ALLOCATED_OBJECT *object_ptr;
ALIGN_TYPE object_end;
ALIGN_TYPE object_pool_end;
if (module_instance -> txm_module_instance_property_flags & TXM_MODULE_MEMORY_PROTECTION)
{
/* Is the object pool created? */
if (_txm_module_manager_object_pool_created == TX_TRUE)
{
/* Get the module allocated object. */
object_ptr = ((TXM_MODULE_ALLOCATED_OBJECT *) param_0) - 1;
/* Get the end address of the object pool. */
object_pool_end = (ALIGN_TYPE) (_txm_module_manager_object_pool.tx_byte_pool_start + _txm_module_manager_object_pool.tx_byte_pool_size);
/* Check that the pointer is in the object pool. */
if ((ALIGN_TYPE) object_ptr < (ALIGN_TYPE) _txm_module_manager_object_pool.tx_byte_pool_start ||
(ALIGN_TYPE) object_ptr >= (ALIGN_TYPE) object_pool_end)
{
/* Pointer is outside of the object pool. */
return(TXM_MODULE_INVALID_MEMORY);
}
/* Get the end addresses of the object. */
object_end = ((ALIGN_TYPE) object_ptr) + sizeof(TXM_MODULE_ALLOCATED_OBJECT) + object_ptr -> txm_module_object_size;
/* Check that the object is in the object pool. */
if (object_end >= object_pool_end)
{
/* Object is outside of the object pool. */
return(TXM_MODULE_INVALID_MEMORY);
}
}
}
return_value = (ALIGN_TYPE) _txm_module_manager_object_deallocate(
(VOID *) param_0
common_modules/module_manager/inc/txm_module_manager_util.h
+1
View File
@@ -162,6 +162,7 @@ TXM_MODULE_ALLOCATED_OBJECT
UINT _txm_module_manager_object_type_size_get(UINT object_type, ULONG *object_size);
UINT _txm_module_manager_created_object_type_check(ALIGN_TYPE object_ptr, UINT object_type);
UINT _txm_module_manager_object_id_check(ALIGN_TYPE object_ptr, UINT object_type);
UINT _txm_module_manager_live_object_check(ALIGN_TYPE object_ptr);
UINT _txm_module_manager_util_code_allocation_size_and_alignment_get(TXM_MODULE_PREAMBLE *module_preamble, ULONG *code_alignment_dest, ULONG *code_allocation_size_dest);
#endif
common_modules/module_manager/src/txm_module_manager_object_deallocate.c
+38 -3
View File
@@ -44,9 +44,7 @@
/* DEPRECATED. This function is called internally by the Module */
/* Manager dispatch layer after a successful tx_*_delete() call from */
/* a module. It must not be called directly by module or application */
/* code. Calling it on a live kernel object (one whose tx_*_delete() */
/* has not yet been called) frees the backing pool memory while the */
/* object is still referenced by the kernel (use-after-free). */
/* code. */
/* */
/* Module authors: remove any explicit call to */
/* txm_module_object_deallocate(). Calling the appropriate */
@@ -59,6 +57,13 @@
/* header from in front of the address the caller supplied. An */
/* address that names none of this module's allocations returns */
/* TX_PTR_ERROR and is not dereferenced. */
/* Memory holding a live kernel object is not given back. Such a */
/* request returns TX_DELETE_ERROR and changes nothing: the object */
/* stays created, the allocation stays on the module's allocation */
/* list, and the memory stays owned by the module. Storage that was */
/* allocated but never made into an object is still released, so a */
/* module can still clean up after a create that failed or was */
/* abandoned. */
/* */
/* INPUT */
/* */
@@ -74,6 +79,7 @@
/* _txe_mutex_put Release module instance mutex */
/* _txm_module_manager_allocated_object_find */
/* Find the module's allocation */
/* _txm_module_manager_live_object_check Check for a live object */
/* _txe_byte_release Release object back to pool */
/* */
/* */
@@ -130,6 +136,35 @@ UINT return_value;
/* Set return value to invalid pointer. */
return_value = TX_PTR_ERROR;
}
/* Determine if a live kernel object is in this memory.
Releasing the memory of a created object leaves the kernel holding the
only references to it. The object stays on the created list for its
type, a thread stays on the ready or suspension list it was on and stays
schedulable, and an active timer stays on the timer list. None of those
consult a control block ID, so nothing about the freed memory stops the
kernel using it: a created list walk reads a name pointer out of it, a
create or delete of another object of the same type writes through the
links in it, the scheduler restores a context from the stack pointer in
it, and timer expiration calls the function pointer in it. The byte pool
is meanwhile free to hand those bytes to the next allocation, so what the
kernel goes on reading as a control block is whatever the next owner of
the memory puts there.
This is asked before the allocation is unlinked, so a refusal leaves the
allocation list, the object and the memory exactly as they were. What is
refused is releasing the memory of an object that is still created; an
allocation that was never made into an object, or one whose object has
been deleted, is released as before, which is what keeps cleanup after a
failed or abandoned create working and what makes the release the delete
dispatchers perform after a successful delete go through. */
else if (_txm_module_manager_live_object_check((ALIGN_TYPE) object_ptr) == TX_TRUE)
{
/* Set return value to indicate the object must be deleted first. */
return_value = TX_DELETE_ERROR;
}
else
{
common_modules/module_manager/src/txm_module_manager_util.c
+103 -7
View File
@@ -1021,13 +1021,18 @@ UINT exact_object;
/* This function determines whether an address is the exact address */
/* of an object on the kernel's created list for a module object type. */
/* */
/* This is how an object the application created and shared with a */
/* module is authenticated. Such an object is not in the manager's */
/* object pool and the manager has no allocation record of it, so the */
/* kernel's own created list is the only record of it that a module */
/* cannot influence. Being on that list establishes at once that the */
/* address is an object start, that the object is of this type, and */
/* that it is created. */
/* The created list is the record the create and delete services */
/* maintain, so being on it establishes at once that the address is an */
/* object start rather than an address inside an object, that the */
/* object is of this type, and that it has not been deleted. It is */
/* also the only record of an object the application created and */
/* shared with a module, since the manager allocated no such object. */
/* */
/* Nothing the module can influence is consulted. In particular the */
/* control block ID is not: a module can arrange for the value of an */
/* ID to appear inside memory it owns, and distinct object types of */
/* equal size exist, so an ID is not evidence that an object is there */
/* nor of what type it is. */
/* */
/* INPUT */
/* */
@@ -1045,6 +1050,7 @@ UINT exact_object;
/* */
/* CALLED BY */
/* */
/* _txm_module_manager_live_object_check Module object liveness check */
/* _txm_module_manager_param_check_typed_object_for_use */
/* Module object authentication */
/* */
@@ -1402,6 +1408,96 @@ UINT status;
}
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
/* */
/* _txm_module_manager_live_object_check PORTABLE C */
/* 6.4.3 */
/* AUTHOR */
/* */
/* Eclipse ThreadX contributors */
/* */
/* DESCRIPTION */
/* */
/* This function determines whether an address is the exact address */
/* of a live kernel object of any type the Module Manager knows. */
/* */
/* It answers the question object deallocation has to ask before it */
/* gives memory back: is the kernel still going to use these bytes as */
/* a control block. Deallocation is told an address and nothing else, */
/* so unlike the checks a typed service makes it cannot be given the */
/* type to look for, and every type has to be looked for in turn. */
/* */
/* The eight created lists are searched whatever the size of the */
/* allocation at the address. Skipping a type whose control block is */
/* larger than the allocation would be sound only if every object had */
/* been created through a size-checked path, and a module running */
/* without memory protection creates objects without one. */
/* */
/* Each list is searched in its own interrupts-disabled window rather */
/* than all of them in one, so the longest window is bounded by the */
/* number of objects of a single type. The whole search costs one pass */
/* over the objects the system has created, and is paid once per */
/* object deallocation. */
/* */
/* INPUT */
/* */
/* object_ptr Address of object memory area */
/* */
/* OUTPUT */
/* */
/* TX_TRUE A live kernel object is there */
/* TX_FALSE Anything else */
/* */
/* CALLS */
/* */
/* _txm_module_manager_created_object_type_check */
/* Check one kernel created list */
/* */
/* CALLED BY */
/* */
/* _txm_module_manager_object_deallocate Deallocate object memory */
/* */
/* RELEASE HISTORY */
/* */
/* DATE NAME DESCRIPTION */
/* */
/* xx-xx-2026 Eclipse ThreadX Initial Version 6.4.3 */
/* contributors */
/* */
/**************************************************************************/
UINT _txm_module_manager_live_object_check(ALIGN_TYPE object_ptr)
{
UINT object_type;
UINT status;
/* Assume no live object is there. */
status = TX_FALSE;
/* The eight module object types that have a kernel created list occupy a
contiguous range, so each is asked in turn by walking the range. A value in
the range that the per-type check does not recognise answers TX_FALSE, so a
type the manager stops knowing does not silently pass this search. */
for (object_type = ((UINT) TXM_BLOCK_POOL_OBJECT); object_type <= ((UINT) TXM_TIMER_OBJECT); object_type++)
{
if (_txm_module_manager_created_object_type_check(object_ptr, object_type) == TX_TRUE)
{
/* An address is the start of at most one object, so there is nothing
further to look for. */
status = TX_TRUE;
break;
}
}
return(status);
}
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
ctest-all.log
+220
View File
File diff suppressed because it is too large Load Diff
test/tx/cmake/module_manager/CMakeLists.txt
+26
View File
@@ -127,3 +127,29 @@ target_compile_options(
add_test(${CMAKE_BUILD_TYPE}::threadx_module_manager_delete_ownership_test
threadx_module_manager_delete_ownership_test)
# This test drives the allocation and deallocation services directly rather than
# through a dispatcher, so it needs none of the dispatch table and no guard list.
add_executable(
threadx_module_manager_live_object_deallocation_test
${SOURCE_DIR}/threadx_module_manager_live_object_deallocation_test.c
${module_manager_dir}/src/txm_module_manager_util.c
${module_manager_dir}/src/txm_module_manager_object_allocate.c
${module_manager_dir}/src/txm_module_manager_object_deallocate.c)
target_include_directories(
threadx_module_manager_live_object_deallocation_test
PRIVATE ${SOURCE_DIR}
${REPO_ROOT}/common/inc
${REPO_ROOT}/common_modules/inc
${module_manager_dir}/inc
${cortex_a7_module_dir}/inc)
target_compile_options(
threadx_module_manager_live_object_deallocation_test
PRIVATE -Wall
-Wextra
-include ${SOURCE_DIR}/threadx_module_manager_host_test_port.h)
add_test(${CMAKE_BUILD_TYPE}::threadx_module_manager_live_object_deallocation_test
threadx_module_manager_live_object_deallocation_test)
test/tx/module_manager/threadx_module_manager_live_object_deallocation_test.c
+1223
View File
File diff suppressed because it is too large Load Diff
test/tx/module_manager/threadx_module_manager_object_authentication_test.c
+18 -11
View File
@@ -854,26 +854,33 @@ char description[128];
test_expect("a live queue is accepted before anything is given back",
test_authenticate(&module_a, object, TXM_QUEUE_OBJECT), (ULONG) TX_TRUE);
/* Give the memory back without deleting the object first. The manager stops
vouching for the control block at the moment it stops owning the memory, so
the address is refused even though the created list has not been told. */
/* Memory holding a live object is not given back at all. The object stays
created, the allocation stays owned, and the address stays authentic, so
the state this once had to defend against -- an object on the created list
whose memory the manager no longer owns -- cannot be reached. */
_tx_thread_current_ptr = (TX_THREAD *) test_allocate(&module_a, (ULONG) sizeof(TX_THREAD));
_tx_thread_current_ptr -> tx_thread_module_instance_ptr = &module_a;
status = _txm_module_manager_object_deallocate(object);
test_expect("memory holding a live object is not given back", (ULONG) status, (ULONG) TX_DELETE_ERROR);
test_expect("and the live object is still accepted afterwards",
test_authenticate(&module_a, object, TXM_QUEUE_OBJECT), (ULONG) TX_TRUE);
/* Deleted first, the same memory is given back, and the address comes round
again as a fresh, raw allocation. It is once again an exact allocation start
of the right size, and the ID of the object that used to be there can be
written back into it by the module that now owns it, so the created list is
the only thing that refuses it. */
test_object_delete(object, kind -> test_kind_type);
test_release_size(kind -> test_kind_size);
status = _txm_module_manager_object_deallocate(object);
test_expect("the object memory is given back", (ULONG) status, (ULONG) TX_SUCCESS);
test_expect("a deleted object's memory is given back", (ULONG) status, (ULONG) TX_SUCCESS);
test_expect("an address whose memory was given back without a delete is refused",
test_authenticate(&module_a, object, TXM_QUEUE_OBJECT), (ULONG) TX_FALSE);
/* The same address now comes back as a fresh, raw allocation. It is once
again an exact allocation start of the right size, and it is still on the
created list, so nothing but the cleared ID stands between it and being
taken for the object that used to be there. */
raw_object = test_allocate(&module_a, kind -> test_kind_size);
test_expect("the freed address is handed out again",
(ULONG) (raw_object == object), (ULONG) TX_TRUE);
(VOID) test_plant(raw_object, ((ULONG) 0), kind -> test_kind_id);
test_expect("and is not accepted as the object that used to be there",
test_authenticate(&module_a, raw_object, TXM_QUEUE_OBJECT), (ULONG) TX_FALSE);