Skip to content

Conversation

@xiaoxiang781216
Copy link
Contributor

No description provided.

1.Add semaphore uninterruptible wait function
2.Replace semaphore wait loop with a single uninterruptible wait
3.Replace all sem_xxx to nxsem_xxx

Change-Id: Ibde993435b011c5dda967f4445a8e791dba72aa3
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
1.Remove void cast for function because many place ignore the returned value witout cast
2.Replace void cast for variable with UNUSED macro

Change-Id: Ie94ee2c34141909d06a192e6bf6104e5696bef41
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
@patacongo patacongo merged commit 73c2d42 into apache:dev Jan 2, 2020
patacongo pushed a commit that referenced this pull request Jan 2, 2020
* Simplify EINTR/ECANCEL error handling

1. Add semaphore uninterruptible wait function
2 .Replace semaphore wait loop with a single uninterruptible wait
3. Replace all sem_xxx to nxsem_xxx

* Unify the void cast usage

1. Remove void cast for function because many place ignore the returned value witout cast
2. Replace void cast for variable with UNUSED macro
@xiaoxiang781216 xiaoxiang781216 deleted the fix-wait-loop-and-void-cast branch January 2, 2020 16:57
@patacongo
Copy link
Contributor

Removing the (void) cast actually violates the coding standard. Look at:

http://nuttx.org/Documentation/NuttXCCodingStandard.html#retvalues

Checking Return Values. Callers of internal OS functions should always check return values for an error. At a minimum, a debug statement should indicate that an error has occurred. The calling logic intentionally ignores the returned value, then the function return value should be explicitly cast to (void) to indicate that the return value is intentionally ignored. An exception of for standard functions for which people have historically ignored the returned values, such as printf() or close. All calls to malloc or realloc must be checked for failures to allocate memory.

patacongo pushed a commit that referenced this pull request Jan 3, 2020
* Simplify EINTR/ECANCEL error handling

1. Add semaphore uninterruptible wait function
2 .Replace semaphore wait loop with a single uninterruptible wait
3. Replace all sem_xxx to nxsem_xxx

* Unify the void cast usage

1. Remove void cast for function because many place ignore the returned value witout cast
2. Replace void cast for variable with UNUSED macro
@juniskane
Copy link
Contributor

This PR completely breaks usrsock networking for one of our projects. Underlying cause is not clear but creating a revert for commit 6a3c2ad fixed it. I suggest reverting this in any case as merging insanely big PRs like this that confuse several unrelated concepts into single commit make root cause analysis extra hard.

@xiaoxiang781216
Copy link
Contributor Author

@juniskane could you point out which patch break your networking? or which socket function break?

@xiaoxiang781216
Copy link
Contributor Author

Please help me identify which patch generate the regression like this:
1.git revert 6a3c2ad
2.download https://github.com/apache/incubator-nuttx/commit/a5aac1fd5515e2447785025da4102c5b04fc6389.patch
3.git am download-file.patch
And run your test case.

@xiaoxiang781216
Copy link
Contributor Author

xiaoxiang781216 commented Jan 8, 2020

Does the error like this:
proxy> ping 127.0.0.1
ERROR: socket() failed: 110
proxy>

@jkivilin
Copy link
Contributor

jkivilin commented Jan 8, 2020

Bug appears to be reproducable with 'usrsocktest' testing application (CONFIG_EXAMPLES_USRSOCKTEST=y).

The config I used for quick test is at https://gist.github.com/jkivilin/7d7558b54a85fd70c8a439d6d8feba5e

With offending commit reverted, I get output:

$ ./nuttx 

NuttShell (NSH) NuttX-8.2
MOTD: username=admin password=Administrator
nsh> usrsocktest
Starting unit-tests...
Testing group "CharDev" =>
        Group "CharDev": [OK]
Testing group "NoDaemon" =>
        Group "NoDaemon": [OK]
Testing group "BasicDaemon" =>
        Group "BasicDaemon": [OK]
Testing group "BasicConnect" =>
        Group "BasicConnect": [OK]
Testing group "BasicConnectDelay" =>
        Group "BasicConnectDelay": [OK]
Testing group "NoBlockConnect" =>
        Group "NoBlockConnect": [OK]
Testing group "BasicSend" =>
        Group "BasicSend": [OK]
Testing group "NoBlockSend" =>
        Group "NoBlockSend": [OK]
Testing group "BlockSend" =>
        Group "BlockSend": [OK]
Testing group "NoBlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "Receive":
                line 200: Assertion `memcmp((&remoteaddr), (&addr), (addrlen)) == 0' failed.
        Group "NoBlockRecv": [FAILED]
Testing group "BlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "NoBlockConnect":
                line 268: Assertion `memcmp((&remoteaddr), (&addr), (addrlen)) == 0' failed.
        Group "BlockRecv": [FAILED]
Testing group "RemoteDisconnect" =>
        Group "RemoteDisconnect": [OK]
Testing group "BasicSetSockOpt" =>
        Group "BasicSetSockOpt": [OK]
Testing group "BasicGetSockOpt" =>
        Group "BasicGetSockOpt": [OK]
Testing group "BasicGetSockName" =>
Segmentation fault (core dumped)

There is some other issue that causes test-cases to fail, but when 6a3c2ad is not reverted, the output changes. Now I get different errors, first being at 'Testing group "BasicSend"':

$ ./nuttx 

NuttShell (NSH) NuttX-8.2
MOTD: username=admin password=Administrator
nsh> 
nsh> usrsocktest
Starting unit-tests...
Testing group "CharDev" =>
        Group "CharDev": [OK]
Testing group "NoDaemon" =>
        Group "NoDaemon": [OK]
Testing group "BasicDaemon" =>
        Group "BasicDaemon": [OK]
Testing group "BasicConnect" =>
        Group "BasicConnect": [OK]
Testing group "BasicConnectDelay" =>
        Group "BasicConnectDelay": [OK]
Testing group "NoBlockConnect" =>
        Group "NoBlockConnect": [OK]
Testing group "BasicSend" =>
        [TEST ASSERT FAILED!]
                In function "ConnectSend":
                line 244: Assertion `(ssize_t)((ret)) == (ssize_t)((datalen))' failed.
                        got value: -1
                        should be: 4
        Group "BasicSend": [FAILED]
Testing group "NoBlockSend" =>
        [TEST ASSERT FAILED!]
                In function "Send":
                line 111: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "NoBlockSend": [FAILED]
Testing group "BlockSend" =>
        [TEST ASSERT FAILED!]
                In function "ConnectSend":
                line 112: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "BlockSend": [FAILED]
Testing group "NoBlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "Receive":
                line 115: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "NoBlockRecv": [FAILED]
Testing group "BlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "ConnectReceive":
                line 114: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "BlockRecv": [FAILED]
Testing group "RemoteDisconnect" =>
        [TEST ASSERT FAILED!]
                In function "Unreachable":
                line 115: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "RemoteDisconnect": [FAILED]
Testing group "BasicSetSockOpt" =>
        [TEST ASSERT FAILED!]
                In function "Open":
                line 105: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "BasicSetSockOpt": [FAILED]
Testing group "BasicGetSockOpt" =>
        [TEST ASSERT FAILED!]
                In function "Open":
                line 105: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "BasicGetSockOpt": [FAILED]
Testing group "BasicGetSockName" =>
        [TEST ASSERT FAILED!]
                In function "Open":
                line 110: Assertion `(ssize_t)((usrsocktest_daemon_start(dconf))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "BasicGetSockName": [FAILED]
Testing group "WakeWithSignal" =>
        [TEST ASSERT FAILED!]
                In function "do_wake_test":
                line 487: Assertion `(ssize_t)((usrsocktest_daemon_start(&usrsocktest_daemon_config))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "WakeWithSignal": [FAILED]
Testing group "MultiThread" =>
        [TEST ASSERT FAILED!]
                In function "usrsocktest_test_MultiThread_OpenClose":
                line 221: Assertion `(ssize_t)((usrsocktest_daemon_start(&usrsocktest_daemon_config))) == (ssize_t)((0))' failed.
                        got value: -120
                        should be: 0
        Group "MultiThread": [FAILED]
Unit-test groups done... OK:6, FAILED:11, TOTAL:17
 -- number of checks made: 786
HEAP BEFORE TESTS:
             total       used       free    largest
Mem:       4194304    1597616    2596688    2596432
HEAP AFTER TESTS:
             total       used       free    largest
Mem:       4194304    1607440    2586864    2586800
nsh>

Maybe above can be used to locate the issue?

@jkivilin
Copy link
Contributor

jkivilin commented Jan 8, 2020

With 6a3c2ad reverted and https://github.com/apache/incubator-nuttx/commit/a5aac1fd5515e2447785025da4102c5b04fc6389.patch applied, usrsocktest output is the same (so problem is not with in a5aac1f):

$ ./nuttx 

NuttShell (NSH) NuttX-8.2
MOTD: username=admin password=Administrator
nsh> usrsocktest
Starting unit-tests...
Testing group "CharDev" =>
        Group "CharDev": [OK]
Testing group "NoDaemon" =>
        Group "NoDaemon": [OK]
Testing group "BasicDaemon" =>
        Group "BasicDaemon": [OK]
Testing group "BasicConnect" =>
        Group "BasicConnect": [OK]
Testing group "BasicConnectDelay" =>
        Group "BasicConnectDelay": [OK]
Testing group "NoBlockConnect" =>
        Group "NoBlockConnect": [OK]
Testing group "BasicSend" =>
        Group "BasicSend": [OK]
Testing group "NoBlockSend" =>
        Group "NoBlockSend": [OK]
Testing group "BlockSend" =>
        Group "BlockSend": [OK]
Testing group "NoBlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "Receive":
                line 200: Assertion `memcmp((&remoteaddr), (&addr), (addrlen)) == 0' failed.
        Group "NoBlockRecv": [FAILED]
Testing group "BlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "NoBlockConnect":
                line 268: Assertion `memcmp((&remoteaddr), (&addr), (addrlen)) == 0' failed.
        Group "BlockRecv": [FAILED]
Testing group "RemoteDisconnect" =>
        Group "RemoteDisconnect": [OK]
Testing group "BasicSetSockOpt" =>
        Group "BasicSetSockOpt": [OK]
Testing group "BasicGetSockOpt" =>
        Group "BasicGetSockOpt": [OK]
Testing group "BasicGetSockName" =>
Segmentation fault (core dumped)

@xiaoxiang781216
Copy link
Contributor Author

Ok, let me repro on simulator with your config

@juniskane
Copy link
Contributor

I agree with Jussi, problem is caused by a9ff3e1, not the other commit. I cannot spot the problem by code reading unfortunately.

This is usrsocktest with old upstream merge from December (some of the SHAs here are from our internal repository) running on proprietary STM32L4 board. Something is broken, but not as much as with a9ff3e1:

usrsocktest_Dec16_master_9e3bf44870.txt

Broken master:

usrsocktest_Jan08_devel_5ff90c1aa27.txt

Broken master + this PR reverted (identical with Dec 16 output):

usrsocktest_Jan08_devel_revert_5864cf8e038.txt

Broken master + this PR reverted + add a9ff3e1 (identical with broken master)

usrsocktest_Jan08_devel_revert_and_add_a9ff3e1778d950f7d7.txt

@juniskane
Copy link
Contributor

juniskane commented Jan 9, 2020

This is unrelated, but why is priv->tx_result ignored here (different than priv->rx_result handling)?

@@ -645,23 +637,7 @@ static void spi_dmarxwait(FAR struct stm32l4_spidev_s *priv)
 #ifdef CONFIG_STM32L4_SPI_DMA
 static void spi_dmatxwait(FAR struct stm32l4_spidev_s *priv)
 {
-  int ret;
-
-  /* Take the semaphore (perhaps waiting).  If the result is zero, then the DMA
-   * must not really have completed???
-   */
-
-  do
-    {
-      ret = nxsem_wait(&priv->txsem);
-
-      /* The only case that an error should occur here is if the wait was
-       * awakened by a signal.
-       */
-
-      DEBUGASSERT(ret == OK || ret == -EINTR);
-    }
-  while (ret == -EINTR || priv->txresult == 0);
+  nxsem_wait_uninterruptible(&priv->txsem);
 }
 #endif

@xiaoxiang781216
Copy link
Contributor Author

This is unrelated, but why is priv->tx_result ignored here (different than priv->rx_result handling)?

@@ -645,23 +637,7 @@ static void spi_dmarxwait(FAR struct stm32l4_spidev_s *priv)
 #ifdef CONFIG_STM32L4_SPI_DMA
 static void spi_dmatxwait(FAR struct stm32l4_spidev_s *priv)
 {
-  int ret;
-
-  /* Take the semaphore (perhaps waiting).  If the result is zero, then the DMA
-   * must not really have completed???
-   */
-
-  do
-    {
-      ret = nxsem_wait(&priv->txsem);
-
-      /* The only case that an error should occur here is if the wait was
-       * awakened by a signal.
-       */
-
-      DEBUGASSERT(ret == OK || ret == -EINTR);
-    }
-  while (ret == -EINTR || priv->txresult == 0);
+  nxsem_wait_uninterruptible(&priv->txsem);
 }
 #endif

My intention is to remove all result check since only interrupt handler will post semaphore, the check is redundant.

@xiaoxiang781216
Copy link
Contributor Author

With 6a3c2ad reverted and https://github.com/apache/incubator-nuttx/commit/a5aac1fd5515e2447785025da4102c5b04fc6389.patch applied, usrsocktest output is the same (so problem is not with in a5aac1f):

$ ./nuttx 

NuttShell (NSH) NuttX-8.2
MOTD: username=admin password=Administrator
nsh> usrsocktest
Starting unit-tests...
Testing group "CharDev" =>
        Group "CharDev": [OK]
Testing group "NoDaemon" =>
        Group "NoDaemon": [OK]
Testing group "BasicDaemon" =>
        Group "BasicDaemon": [OK]
Testing group "BasicConnect" =>
        Group "BasicConnect": [OK]
Testing group "BasicConnectDelay" =>
        Group "BasicConnectDelay": [OK]
Testing group "NoBlockConnect" =>
        Group "NoBlockConnect": [OK]
Testing group "BasicSend" =>
        Group "BasicSend": [OK]
Testing group "NoBlockSend" =>
        Group "NoBlockSend": [OK]
Testing group "BlockSend" =>
        Group "BlockSend": [OK]
Testing group "NoBlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "Receive":
                line 200: Assertion `memcmp((&remoteaddr), (&addr), (addrlen)) == 0' failed.
        Group "NoBlockRecv": [FAILED]
Testing group "BlockRecv" =>
        [TEST ASSERT FAILED!]
                In function "NoBlockConnect":
                line 268: Assertion `memcmp((&remoteaddr), (&addr), (addrlen)) == 0' failed.
        Group "BlockRecv": [FAILED]
Testing group "RemoteDisconnect" =>
        Group "RemoteDisconnect": [OK]
Testing group "BasicSetSockOpt" =>
        Group "BasicSetSockOpt": [OK]
Testing group "BasicGetSockOpt" =>
        Group "BasicGetSockOpt": [OK]
Testing group "BasicGetSockName" =>
Segmentation fault (core dumped)

I test your config on my simulator, the result isn't stable: BasicSend can pass sometime, but will hit segmentation fault at the later time. The old release can pass BaiscSend stably, but also will hit segmentation fault.

@juniskane
Copy link
Contributor

This could be it:

diff --git a/net/usrsock/usrsock_dev.c b/net/usrsock/usrsock_dev.c
index 9359fd0..2bca669 100644
--- a/net/usrsock/usrsock_dev.c
+++ b/net/usrsock/usrsock_dev.c
@@ -1166,7 +1166,7 @@ int usrsockdev_do_request(FAR struct usrsock_conn_s *conn,
 {
   FAR struct usrsockdev_s *dev = conn->dev;
   FAR struct usrsock_request_common_s *req_head = iov[0].iov_base;
-  int ret;
+  int ret = OK;
 
   if (!dev)
     {

still looking at the patch if there more instances....

@jkivilin
Copy link
Contributor

jkivilin commented Jan 9, 2020

Ok. So, before adding net_lockedwait_uninterruptible, ret was being initialized by

     while ((ret = net_lockedwait(&dev->req.acksem)) < 0)
       {
         DEBUGASSERT(ret == -EINTR || ret == -ECANCELED);
       }

and return value from net_lockedwait was returned for usrsockdev_do_request but that's no longer the case.

@juniskane
Copy link
Contributor

juniskane commented Jan 9, 2020

There is still something wrong. After this PR and above fix I still get error when doing netcat over cellular connection. DNS is resolved correctly but there is "polling error 12" that was not there before:

[EDITED: archive trace to comment history]

Nevermind, fixed this by increasing CONFIG_NET_USRSOCK_NPOLLWAITERS from 1 to 2.

@xiaoxiang781216
Copy link
Contributor Author

There is still something wrong. After this PR and above fix I still get error when doing netcat over cellular connection. DNS is resolved correctly but there is "polling error 12" that was not there before:

[EDITED: archive trace to comment history]

Nevermind, fixed this by increasing CONFIG_NET_USRSOCK_NPOLLWAITERS from 1 to 2.

Thanks for finding the tough bug, could you send the patch fix both issues?

@xiaoxiang781216
Copy link
Contributor Author

This could be it:

diff --git a/net/usrsock/usrsock_dev.c b/net/usrsock/usrsock_dev.c
index 9359fd0..2bca669 100644
--- a/net/usrsock/usrsock_dev.c
+++ b/net/usrsock/usrsock_dev.c
@@ -1166,7 +1166,7 @@ int usrsockdev_do_request(FAR struct usrsock_conn_s *conn,
 {
   FAR struct usrsockdev_s *dev = conn->dev;
   FAR struct usrsock_request_common_s *req_head = iov[0].iov_base;
-  int ret;
+  int ret = OK;
 
   if (!dev)
     {

still looking at the patch if there more instances....

Good finding, it explain why sometime the test case can pass, but sometime not.

@juniskane
Copy link
Contributor

I have not reviewed CONFIG_NET_USRSOCK_NPOLLWAITERS in upstream configs. I'd expect that to be 1 most of time (only one waiting for a given socket) so no patch for that. Users of usersock have to review their projects for this value. We also found similar issues with 'ret' in:

wireless/bluetooth/bt_hcicore.c
drivers/sensors/hc_sr04.c

Details forthcoming...

@juniskane
Copy link
Contributor

juniskane commented Jan 9, 2020

Likely caused by this PR:

Issue 1: In bt_hci_cmd_send_sync():

bt_hcicore

Issue 2: (also found by Jussi Kivilinna) In hcsr04_ioctl() with SNIOC_READ_RAW_DATA, uninitialized 'ret' is returned. This ioctl command also looks useless as no read data is returned to caller. Driver author @acassis to comment/fix this?

No patch for these, just want to report bugs.

@xiaoxiang781216
Copy link
Contributor Author

@acassis here is the fix:
#67
Thanks very much, @juniskane.

@acassis
Copy link
Contributor

acassis commented Jan 9, 2020

Done! Thank you Xiao Xiang!

@juniskane
Copy link
Contributor

@@ -645,23 +637,7 @@ static void spi_dmarxwait(FAR struct stm32l4_spidev_s *priv)
 #ifdef CONFIG_STM32L4_SPI_DMA
 static void spi_dmatxwait(FAR struct stm32l4_spidev_s *priv)
 {
-  int ret;
-
-  /* Take the semaphore (perhaps waiting).  If the result is zero, then the DMA
-   * must not really have completed???
-   */
-
-  do
-    {
-      ret = nxsem_wait(&priv->txsem);
-
-      /* The only case that an error should occur here is if the wait was
-       * awakened by a signal.
-       */
-
-      DEBUGASSERT(ret == OK || ret == -EINTR);
-    }
-  while (ret == -EINTR || priv->txresult == 0);
+  nxsem_wait_uninterruptible(&priv->txsem);
 }
 #endif

My intention is to remove all result check since only interrupt handler will post semaphore, the check is redundant.

Any reason why this bit of code is now done differently for stm32f7 and stm32f0l0g0 than for other STM32?

@xiaoxiang781216
Copy link
Contributor Author

@@ -645,23 +637,7 @@ static void spi_dmarxwait(FAR struct stm32l4_spidev_s *priv)
 #ifdef CONFIG_STM32L4_SPI_DMA
 static void spi_dmatxwait(FAR struct stm32l4_spidev_s *priv)
 {
-  int ret;
-
-  /* Take the semaphore (perhaps waiting).  If the result is zero, then the DMA
-   * must not really have completed???
-   */
-
-  do
-    {
-      ret = nxsem_wait(&priv->txsem);
-
-      /* The only case that an error should occur here is if the wait was
-       * awakened by a signal.
-       */
-
-      DEBUGASSERT(ret == OK || ret == -EINTR);
-    }
-  while (ret == -EINTR || priv->txresult == 0);
+  nxsem_wait_uninterruptible(&priv->txsem);
 }
 #endif

My intention is to remove all result check since only interrupt handler will post semaphore, the check is redundant.

Any reason why this bit of code is now done differently for stm32f7 and stm32f0l0g0 than for other STM32?

I will provide a patch to bring back "do {} while (priv->XXresult == 0);".

@xiaoxiang781216
Copy link
Contributor Author

@juniskane here is the patch:
#77

@lukegluke
Copy link
Contributor

Hi @xiaoxiang781216, @jkivilin!

I have some problems running usrsocktest, few of them looks similar to those mentioned in this issue.
изображение

I've described my issues in dev@nuttx.apache.org mailing list - topic: "Usrsocktest app example fails"
I think it is not really related to this issue, but I wonder if usrsocktest now runs correctly for you in latest NuttX, without any errors?
Thanks for feedback.

@xiaoxiang781216
Copy link
Contributor Author

Hi @xiaoxiang781216, @jkivilin!

I have some problems running usrsocktest, few of them looks similar to those mentioned in this issue.

I've described my issues in dev@nuttx.apache.org mailing list - topic: "Usrsocktest app example fails"
I think it is not really related to this issue, but I wonder if usrsocktest now runs correctly for you in latest NuttX, without any errors?
Thanks for feedback.

As I remember there are two test case fail even after this fix, I will look at these two fail today or tomorrow.

@xiaoxiang781216
Copy link
Contributor Author

xiaoxiang781216 commented Feb 21, 2020

@lukegluke , @masayuki2009 create a fix here, please try it:
apache/nuttx-apps#85
#345

@lukegluke
Copy link
Contributor

@lukegluke , @masayuki2009 create a fix here, please try it:
apache/incubator-nuttx-apps#85
#345

Thanks, it fix fails in NoBlockRecv and BlockRecv indeed, but there are more complicated errors that (as I think) involve net stack.
Here more detail output with CONFIG_DEBUG_NET_ERROR and CONFIG_DEBUG_NET_WARN.

nsh> Starting unit-tests...
Testing group "CharDev" =>
usrsockdev_open: failed to open
        Group "CharDev": [OK]
Testing group "NoDaemon" =>
usrsock_sockif_setup: WARNING: usrsock daemon is not running
psock_socket: ERROR: socket address family unsupported: 2
socket: ERROR: psock_socket() failed: -106
        Group "NoDaemon": [OK]
Testing group "BasicDaemon" =>
socket: ERROR: psock_socket() failed: -123
socket: ERROR: psock_socket() failed: -123
socket: ERROR: psock_socket() failed: -123
socket: ERROR: psock_socket() failed: -123
socket: ERROR: psock_socket() failed: -24
socket: ERROR: psock_socket() failed: -24
        Group "BasicDaemon": [OK]
Testing group "BasicConnect" =>
        Group "BasicConnect": [OK]
Testing group "BasicConnectDelay" =>
        Group "BasicConnectDelay": [OK]
Testing group "NoBlockConnect" =>
        Group "NoBlockConnect": [OK]
Testing group "BasicSend" =>
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -128
psock_sendto: ERROR:  Family-specific send failed: -128
psock_sendto: ERROR:  Family-specific send failed: -127
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -128
psock_sendto: ERROR:  Family-specific send failed: -128
psock_sendto: ERROR:  Family-specific send failed: -127
        Group "BasicSend": [OK]
Testing group "NoBlockSend" =>
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -11
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -11
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -11
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -11
        Group "NoBlockSend": [OK]
Testing group "BlockSend" =>
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -11
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -11
        Group "BlockSend": [OK]
Testing group "NoBlockRecv" =>
        Group "NoBlockRecv": [OK]
Testing group "BlockRecv" =>
        Group "BlockRecv": [OK]
Testing group "RemoteDisconnect" =>
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
psock_send: ERROR: socket si_send() (or usrsock_sendto()) failed: -32
        Group "RemoteDisconnect": [OK]
Testing group "BasicSetSockOpt" =>
        Group "BasicSetSockOpt": [OK]
Testing group "BasicGetSockOpt" =>
        Group "BasicGetSockOpt": [OK]
Testing group "BasicGetSockName" =>
        [TEST ASSERT FAILED!]
                In function "Open":
                line 176: Assertion `(ssize_t)((ret)) == (ssize_t)((-1))' failed.
                        got value: 0
                        should be: -1
        Group "BasicGetSockName": [FAILED]
Testing group "WakeWithSignal" =>
up_assert: Assertion failed at file:semaphore/sem_holder.c line: 128 task: usrsocktest

@xiaoxiang781216 xiaoxiang781216 mentioned this pull request Feb 22, 2020
donghengqaz added a commit to donghengqaz/incubator-nuttx that referenced this pull request Jul 20, 2020
…ssage_by_application_api

xtensa/esp32: Fix ISR send message to queue by application API
Shunichi-K referenced this pull request in SPRESENSE/nuttx Nov 7, 2022
* Simplify EINTR/ECANCEL error handling

1. Add semaphore uninterruptible wait function
2 .Replace semaphore wait loop with a single uninterruptible wait
3. Replace all sem_xxx to nxsem_xxx

* Unify the void cast usage

1. Remove void cast for function because many place ignore the returned value witout cast
2. Replace void cast for variable with UNUSED macro
chenzhihong007 pushed a commit to hpmicro/nuttx that referenced this pull request Aug 1, 2023
- recorganize spi driver

Signed-off-by: Runcheng Lu <runcheng.lu@hpmicro.com>
chenzhihong007 pushed a commit to hpmicro/nuttx that referenced this pull request Feb 23, 2024
- recorganize spi driver

Signed-off-by: Runcheng Lu <runcheng.lu@hpmicro.com>
GUIDINGLI added a commit to GUIDINGLI/incubator-nuttx that referenced this pull request Oct 11, 2024
set CONFIG_PRIORITY_INHERITANCE=y
set CONFIG_SEM_PREALLOCHOLDERS=0 or CONFIG_SEM_PREALLOCHOLDERS=8

    apache#24 0x4dcab71 in __assert assert/lib_assert.c:37
    apache#25 0x4d6b0e9 in nxsem_destroyholder semaphore/sem_holder.c:602
    apache#26 0x4d80cf7 in nxsem_destroy semaphore/sem_destroy.c:80
    apache#27 0x4d80db9 in sem_destroy semaphore/sem_destroy.c:120
    apache#28 0x4dcb077 in nxmutex_destroy misc/lib_mutex.c:122
    apache#29 0x4dc6611 in pipecommon_freedev pipes/pipe_common.c:117
    apache#30 0x4dc7fdc in pipecommon_close pipes/pipe_common.c:397
    apache#31 0x4ed4f6d in file_close vfs/fs_close.c:78
    apache#32 0x6a91133 in local_free local/local_conn.c:184
    apache#33 0x6a92a9c in local_release local/local_release.c:129
    apache#34 0x6a91d1a in local_subref local/local_conn.c:271
    apache#35 0x6a75767 in local_close local/local_sockif.c:797
    apache#36 0x4e978f6 in psock_close socket/net_close.c:102
    apache#37 0x4eed1b9 in sock_file_close socket/socket.c:115
    apache#38 0x4ed4f6d in file_close vfs/fs_close.c:78
    apache#39 0x4ed1459 in nx_close_from_tcb inode/fs_files.c:754
    apache#40 0x4ed1501 in nx_close inode/fs_files.c:781
    apache#41 0x4ed154a in close inode/fs_files.c:819
    apache#42 0x6bcb9ce in property_get kvdb/client.c:307
    apache#43 0x6bcd465 in property_get_int32 kvdb/common.c:270
    apache#44 0x5106c9a in tz_offset_restore app/miwear_bluetooth.c:745
    apache#45 0x510893f in miwear_bluetooth_main app/miwear_bluetooth.c:1033
    apache#46 0x4dcf5c8 in nxtask_startup sched/task_startup.c:70
    apache#47 0x4d70873 in nxtask_start task/task_start.c:134
    apache#48 0x4e04a07 in pre_start sim/sim_initialstate.c:52

Signed-off-by: ligd <liguiding1@xiaomi.com>
xiaoxiang781216 pushed a commit that referenced this pull request Oct 11, 2024
set CONFIG_PRIORITY_INHERITANCE=y
set CONFIG_SEM_PREALLOCHOLDERS=0 or CONFIG_SEM_PREALLOCHOLDERS=8

    #24 0x4dcab71 in __assert assert/lib_assert.c:37
    #25 0x4d6b0e9 in nxsem_destroyholder semaphore/sem_holder.c:602
    #26 0x4d80cf7 in nxsem_destroy semaphore/sem_destroy.c:80
    #27 0x4d80db9 in sem_destroy semaphore/sem_destroy.c:120
    #28 0x4dcb077 in nxmutex_destroy misc/lib_mutex.c:122
    #29 0x4dc6611 in pipecommon_freedev pipes/pipe_common.c:117
    #30 0x4dc7fdc in pipecommon_close pipes/pipe_common.c:397
    #31 0x4ed4f6d in file_close vfs/fs_close.c:78
    #32 0x6a91133 in local_free local/local_conn.c:184
    #33 0x6a92a9c in local_release local/local_release.c:129
    #34 0x6a91d1a in local_subref local/local_conn.c:271
    #35 0x6a75767 in local_close local/local_sockif.c:797
    #36 0x4e978f6 in psock_close socket/net_close.c:102
    #37 0x4eed1b9 in sock_file_close socket/socket.c:115
    #38 0x4ed4f6d in file_close vfs/fs_close.c:78
    #39 0x4ed1459 in nx_close_from_tcb inode/fs_files.c:754
    #40 0x4ed1501 in nx_close inode/fs_files.c:781
    #41 0x4ed154a in close inode/fs_files.c:819
    #42 0x6bcb9ce in property_get kvdb/client.c:307
    #43 0x6bcd465 in property_get_int32 kvdb/common.c:270
    #44 0x5106c9a in tz_offset_restore app/miwear_bluetooth.c:745
    #45 0x510893f in miwear_bluetooth_main app/miwear_bluetooth.c:1033
    #46 0x4dcf5c8 in nxtask_startup sched/task_startup.c:70
    #47 0x4d70873 in nxtask_start task/task_start.c:134
    #48 0x4e04a07 in pre_start sim/sim_initialstate.c:52

Signed-off-by: ligd <liguiding1@xiaomi.com>
xiaoxiang781216 pushed a commit that referenced this pull request Dec 18, 2024
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, #32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, #4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a00000 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, #24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, #4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
jerpelea pushed a commit to jerpelea/nuttx that referenced this pull request Dec 19, 2024
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, apache#32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, apache#4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a00000 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, apache#24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, apache#4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
xiaoxiang781216 pushed a commit that referenced this pull request Dec 19, 2024
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, #32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, #4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a00000 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, #24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, #4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
linguini1 pushed a commit to CarletonURocketry/nuttx that referenced this pull request Jan 15, 2025
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, apache#32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, #4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a00000 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, apache#24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, #4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
XuNeo pushed a commit to XuNeo/incubator-nuttx that referenced this pull request Feb 12, 2025
The memory should be unpoisoned for usage and poison after no use.

Test:
cmake -Bbuild -GNinja -DBOARD_CONFIG=mps3-an547:nsh
ninja -C build

qemu-system-arm -M mps3-an547 -m 2G -nographic -kernel build/nuttx

Before the fix:

 apache#6  0x0000b95e in _assert (filename=0x47d3c "/arch/arm/src/armv8-m/arm_busfault.c", linenum=115, msg=0x47d34 "panic", regs=0x1006b14)
     at /home/neo/projects/nuttx/nuttx/sched/misc/assert.c:910
 apache#7  0x00001000 in arm_busfault (irq=3, context=0x1006b14, arg=0x0 <up_ndelay>) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_busfault.c:115
 apache#8  0x0000167a in arm_hardfault (irq=3, context=0x1006b14, arg=0x0 <up_ndelay>) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_hardfault.c:97
 apache#9  0x0000af74 in irq_dispatch (irq=3, context=0x1006b14) at /home/neo/projects/nuttx/nuttx/sched/irq/irq_dispatch.c:144
 apache#10 0x000004b2 in arm_doirq (irq=3, regs=0x1006b14) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_doirq.c:111
 apache#11 0x000003a6 in exception_common () at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_exception.S:218
 apache#12 0x00009568 in kasan_show_memory (addr=0x60000000 "", size=1, dumpsize=80) at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:161
 apache#13 0x0000961e in kasan_report (addr=0x60000000, size=1, is_write=false, return_address=0x40d1d <memcmp+28>)
     at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:180
 apache#14 0x00009818 in kasan_check_report (addr=0x60000000, size=1, is_write=false, return_address=0x40d1d <memcmp+28>)
     at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:246
 apache#15 0x000098a2 in __asan_load1_noabort (addr=0x60000000) at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:403
 apache#16 0x00040d1c in memcmp (s1=0x60000000, s2=0x53204, n=7) at /home/neo/projects/nuttx/nuttx/libs/libc/string/lib_memcmp.c:47
 apache#17 0x0003862a in romfs_fsconfigure (rm=0x1007038, data=0x0 <__asan_store16>) at /home/neo/projects/nuttx/nuttx/fs/romfs/fs_romfsutil.c:976
 apache#18 0x000378c0 in romfs_bind (blkdriver=0x1007008, data=0x0 <__asan_store16>, handle=0x1006e58) at /home/neo/projects/nuttx/nuttx/fs/romfs/fs_romfs.c:1192
 apache#19 0x00032388 in nx_mount (source=0x53da4 "/dev/ram1", target=0x53d9c "/pic", filesystemtype=0x53d94 "romfs", mountflags=1, data=0x0 <__asan_store16>)
     at /home/neo/projects/nuttx/nuttx/fs/mount/fs_mount.c:432
 apache#20 0x00046b1a in mps3_bringup () at /home/neo/projects/nuttx/nuttx/boards/arm/mps/mps3-an547/src/mps3_bringup.c:90
 apache#21 0x00046b6e in board_app_initialize (arg=0) at /home/neo/projects/nuttx/nuttx/boards/arm/mps/mps3-an547/src/mps3_bringup.c:236
 apache#22 0x00046a00 in boardctl (cmd=65281, arg=0) at /home/neo/projects/nuttx/nuttx/boards/boardctl.c:370
 apache#23 0x0001d0d8 in nsh_initialize () at /home/neo/projects/nuttx/apps/nshlib/nsh_init.c:149
 apache#24 0x00016e3e in nsh_main (argc=1, argv=0x1005f48) at /home/neo/projects/nuttx/apps/system/nsh/nsh_main.c:71
 apache#25 0x0001a6fc in nxtask_startup (entrypt=0x16e11 <nsh_main>, argc=1, argv=0x1005f48) at /home/neo/projects/nuttx/nuttx/libs/libc/sched/task_startup.c:72
 apache#26 0x000137de in nxtask_start () at /home/neo/projects/nuttx/nuttx/sched/task/task_start.c:116
 apache#27 0x00000000 in ?? ()

kasan_report: kasan detected a read access error, address at 0x60000000,size is 1, return address: 0x40d1d
kasan_show_memory: Shadow bytes around the buggy address:
arm_hardfault: Hard Fault escalation:
arm_busfault: PANIC!!! Bus Fault:
arm_busfault:   IRQ: 3 regs: 0x1006b14
arm_busfault:   BASEPRI: 00000080 PRIMASK: 00000000 IPSR: 00000003 CONTROL: 00000000
arm_busfault:   CFSR: 00008200 HFSR: 40000000 DFSR: 00000000 BFAR: 5fffffb0 AFSR: 00000000
arm_busfault: Bus Fault Reason:
arm_busfault:   Precise data bus error
dump_assert_info: Current Version: NuttX  12.8.0 381d3fe Feb 12 2025 09:16:55 arm
dump_assert_info: Assertion failed panic: at file: /arch/arm/src/armv8-m/arm_busfault.c:115 task: nsh_main process: nsh_main 0x16e11

After:
No crash.

Change-Id: I743783025aa2e8b77a8439d0e8601ab24bc3e109
Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
XuNeo pushed a commit to XuNeo/incubator-nuttx that referenced this pull request Feb 12, 2025
The memory should be unpoisoned for usage and poison after no use.

Test:
cmake -Bbuild -GNinja -DBOARD_CONFIG=mps3-an547:nsh
ninja -C build

qemu-system-arm -M mps3-an547 -m 2G -nographic -kernel build/nuttx

Before the fix:

 apache#6  0x0000b95e in _assert (filename=0x47d3c "/arch/arm/src/armv8-m/arm_busfault.c", linenum=115, msg=0x47d34 "panic", regs=0x1006b14)
     at /home/neo/projects/nuttx/nuttx/sched/misc/assert.c:910
 apache#7  0x00001000 in arm_busfault (irq=3, context=0x1006b14, arg=0x0 <up_ndelay>) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_busfault.c:115
 apache#8  0x0000167a in arm_hardfault (irq=3, context=0x1006b14, arg=0x0 <up_ndelay>) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_hardfault.c:97
 apache#9  0x0000af74 in irq_dispatch (irq=3, context=0x1006b14) at /home/neo/projects/nuttx/nuttx/sched/irq/irq_dispatch.c:144
 apache#10 0x000004b2 in arm_doirq (irq=3, regs=0x1006b14) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_doirq.c:111
 apache#11 0x000003a6 in exception_common () at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_exception.S:218
 apache#12 0x00009568 in kasan_show_memory (addr=0x60000000 "", size=1, dumpsize=80) at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:161
 apache#13 0x0000961e in kasan_report (addr=0x60000000, size=1, is_write=false, return_address=0x40d1d <memcmp+28>)
     at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:180
 apache#14 0x00009818 in kasan_check_report (addr=0x60000000, size=1, is_write=false, return_address=0x40d1d <memcmp+28>)
     at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:246
 apache#15 0x000098a2 in __asan_load1_noabort (addr=0x60000000) at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:403
 apache#16 0x00040d1c in memcmp (s1=0x60000000, s2=0x53204, n=7) at /home/neo/projects/nuttx/nuttx/libs/libc/string/lib_memcmp.c:47
 apache#17 0x0003862a in romfs_fsconfigure (rm=0x1007038, data=0x0 <__asan_store16>) at /home/neo/projects/nuttx/nuttx/fs/romfs/fs_romfsutil.c:976
 apache#18 0x000378c0 in romfs_bind (blkdriver=0x1007008, data=0x0 <__asan_store16>, handle=0x1006e58) at /home/neo/projects/nuttx/nuttx/fs/romfs/fs_romfs.c:1192
 apache#19 0x00032388 in nx_mount (source=0x53da4 "/dev/ram1", target=0x53d9c "/pic", filesystemtype=0x53d94 "romfs", mountflags=1, data=0x0 <__asan_store16>)
     at /home/neo/projects/nuttx/nuttx/fs/mount/fs_mount.c:432
 apache#20 0x00046b1a in mps3_bringup () at /home/neo/projects/nuttx/nuttx/boards/arm/mps/mps3-an547/src/mps3_bringup.c:90
 apache#21 0x00046b6e in board_app_initialize (arg=0) at /home/neo/projects/nuttx/nuttx/boards/arm/mps/mps3-an547/src/mps3_bringup.c:236
 apache#22 0x00046a00 in boardctl (cmd=65281, arg=0) at /home/neo/projects/nuttx/nuttx/boards/boardctl.c:370
 apache#23 0x0001d0d8 in nsh_initialize () at /home/neo/projects/nuttx/apps/nshlib/nsh_init.c:149
 apache#24 0x00016e3e in nsh_main (argc=1, argv=0x1005f48) at /home/neo/projects/nuttx/apps/system/nsh/nsh_main.c:71
 apache#25 0x0001a6fc in nxtask_startup (entrypt=0x16e11 <nsh_main>, argc=1, argv=0x1005f48) at /home/neo/projects/nuttx/nuttx/libs/libc/sched/task_startup.c:72
 apache#26 0x000137de in nxtask_start () at /home/neo/projects/nuttx/nuttx/sched/task/task_start.c:116
 apache#27 0x00000000 in ?? ()

kasan_report: kasan detected a read access error, address at 0x60000000,size is 1, return address: 0x40d1d
kasan_show_memory: Shadow bytes around the buggy address:
arm_hardfault: Hard Fault escalation:
arm_busfault: PANIC!!! Bus Fault:
arm_busfault:   IRQ: 3 regs: 0x1006b14
arm_busfault:   BASEPRI: 00000080 PRIMASK: 00000000 IPSR: 00000003 CONTROL: 00000000
arm_busfault:   CFSR: 00008200 HFSR: 40000000 DFSR: 00000000 BFAR: 5fffffb0 AFSR: 00000000
arm_busfault: Bus Fault Reason:
arm_busfault:   Precise data bus error
dump_assert_info: Current Version: NuttX  12.8.0 381d3fe Feb 12 2025 09:16:55 arm
dump_assert_info: Assertion failed panic: at file: /arch/arm/src/armv8-m/arm_busfault.c:115 task: nsh_main process: nsh_main 0x16e11

After:
No crash.

Change-Id: I743783025aa2e8b77a8439d0e8601ab24bc3e109
Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
XuNeo pushed a commit to XuNeo/incubator-nuttx that referenced this pull request Feb 12, 2025
The memory should be unpoisoned for usage and poison after no use.

Test:
cmake -Bbuild -GNinja -DBOARD_CONFIG=mps3-an547:nsh
ninja -C build

qemu-system-arm -M mps3-an547 -m 2G -nographic -kernel build/nuttx

Before the fix:

 apache#6  0x0000b95e in _assert (filename=0x47d3c "/arch/arm/src/armv8-m/arm_busfault.c", linenum=115, msg=0x47d34 "panic", regs=0x1006b14)
     at /home/neo/projects/nuttx/nuttx/sched/misc/assert.c:910
 apache#7  0x00001000 in arm_busfault (irq=3, context=0x1006b14, arg=0x0 <up_ndelay>) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_busfault.c:115
 apache#8  0x0000167a in arm_hardfault (irq=3, context=0x1006b14, arg=0x0 <up_ndelay>) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_hardfault.c:97
 apache#9  0x0000af74 in irq_dispatch (irq=3, context=0x1006b14) at /home/neo/projects/nuttx/nuttx/sched/irq/irq_dispatch.c:144
 apache#10 0x000004b2 in arm_doirq (irq=3, regs=0x1006b14) at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_doirq.c:111
 apache#11 0x000003a6 in exception_common () at /home/neo/projects/nuttx/nuttx/arch/arm/src/armv8-m/arm_exception.S:218
 apache#12 0x00009568 in kasan_show_memory (addr=0x60000000 "", size=1, dumpsize=80) at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:161
 apache#13 0x0000961e in kasan_report (addr=0x60000000, size=1, is_write=false, return_address=0x40d1d <memcmp+28>)
     at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:180
 apache#14 0x00009818 in kasan_check_report (addr=0x60000000, size=1, is_write=false, return_address=0x40d1d <memcmp+28>)
     at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:246
 apache#15 0x000098a2 in __asan_load1_noabort (addr=0x60000000) at /home/neo/projects/nuttx/nuttx/mm/kasan/hook.c:403
 apache#16 0x00040d1c in memcmp (s1=0x60000000, s2=0x53204, n=7) at /home/neo/projects/nuttx/nuttx/libs/libc/string/lib_memcmp.c:47
 apache#17 0x0003862a in romfs_fsconfigure (rm=0x1007038, data=0x0 <__asan_store16>) at /home/neo/projects/nuttx/nuttx/fs/romfs/fs_romfsutil.c:976
 apache#18 0x000378c0 in romfs_bind (blkdriver=0x1007008, data=0x0 <__asan_store16>, handle=0x1006e58) at /home/neo/projects/nuttx/nuttx/fs/romfs/fs_romfs.c:1192
 apache#19 0x00032388 in nx_mount (source=0x53da4 "/dev/ram1", target=0x53d9c "/pic", filesystemtype=0x53d94 "romfs", mountflags=1, data=0x0 <__asan_store16>)
     at /home/neo/projects/nuttx/nuttx/fs/mount/fs_mount.c:432
 apache#20 0x00046b1a in mps3_bringup () at /home/neo/projects/nuttx/nuttx/boards/arm/mps/mps3-an547/src/mps3_bringup.c:90
 apache#21 0x00046b6e in board_app_initialize (arg=0) at /home/neo/projects/nuttx/nuttx/boards/arm/mps/mps3-an547/src/mps3_bringup.c:236
 apache#22 0x00046a00 in boardctl (cmd=65281, arg=0) at /home/neo/projects/nuttx/nuttx/boards/boardctl.c:370
 apache#23 0x0001d0d8 in nsh_initialize () at /home/neo/projects/nuttx/apps/nshlib/nsh_init.c:149
 apache#24 0x00016e3e in nsh_main (argc=1, argv=0x1005f48) at /home/neo/projects/nuttx/apps/system/nsh/nsh_main.c:71
 apache#25 0x0001a6fc in nxtask_startup (entrypt=0x16e11 <nsh_main>, argc=1, argv=0x1005f48) at /home/neo/projects/nuttx/nuttx/libs/libc/sched/task_startup.c:72
 apache#26 0x000137de in nxtask_start () at /home/neo/projects/nuttx/nuttx/sched/task/task_start.c:116
 apache#27 0x00000000 in ?? ()

kasan_report: kasan detected a read access error, address at 0x60000000,size is 1, return address: 0x40d1d
kasan_show_memory: Shadow bytes around the buggy address:
arm_hardfault: Hard Fault escalation:
arm_busfault: PANIC!!! Bus Fault:
arm_busfault:   IRQ: 3 regs: 0x1006b14
arm_busfault:   BASEPRI: 00000080 PRIMASK: 00000000 IPSR: 00000003 CONTROL: 00000000
arm_busfault:   CFSR: 00008200 HFSR: 40000000 DFSR: 00000000 BFAR: 5fffffb0 AFSR: 00000000
arm_busfault: Bus Fault Reason:
arm_busfault:   Precise data bus error
dump_assert_info: Current Version: NuttX  12.8.0 381d3fe Feb 12 2025 09:16:55 arm
dump_assert_info: Assertion failed panic: at file: /arch/arm/src/armv8-m/arm_busfault.c:115 task: nsh_main process: nsh_main 0x16e11

After:
No crash.

Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants