91aa26774b
TASK A TASK B
malloc()
mm_takesemaphore()
heap holder is set to TASK B
<--- preempt
...
task_exit()
Set to current task to
TASK B
Try to release tcb, and
stack memory
free()
mm_takesemaphore()
- Successfully obtain
semaphore because current
task and heap holder is
same.
Free memory....
Heap corrupt.
This change forces all de-allocations via sched_kfree() and sched_ufree()
to be delayed. Eliminating the immediate de-allocation prevents the
above problem with the the re-entrant semaphore because the deallocation
always occurs on the worker thread, never on TASK B.
There could be consequences in the timing of memory availability. We
will see.
|
||
|---|---|---|
| .. | ||
| clock | ||
| environ | ||
| errno | ||
| group | ||
| init | ||
| irq | ||
| module | ||
| mqueue | ||
| paging | ||
| pthread | ||
| sched | ||
| semaphore | ||
| signal | ||
| task | ||
| timer | ||
| wdog | ||
| wqueue | ||
| .gitignore | ||
| Kconfig | ||
| Makefile | ||