Re: Another mapping DB issue: uses memory after free()
Espen Skoglund <[email protected]>
| Newsgroups | gmane.comp.micro-kernel.l4.l4ka.general |
|---|---|
| Message-ID | <[email protected]> |
[Frank Mehnert] > Hi, > it seems that I encountered another issue of the (new) mapping > database: All I do is starting Sigma0, a root task and a hello > application. Hello requests a 4K (address 0x02000000) from the root > task. Then, hello requests root task to unmap this page > again. During the unmap operation an assertion is triggered and the > kmem free list ist destroyed. [...] > To find out how destroys the kmem_free_list I forced Pistachio to > enter the kernel debugger after kmem::free(f301b000, ...) was > called. Then I set a hardware write breakpoint to address f301b000. > The kernel debugger was entered again from inside mdb_t::mapctrl(). > Please tell me if you need more information. Whooops. Seems I was a bit hasty when I added some code to the MDB last week (really easy bug to find since that's the only part of the MDB that hasn't gone through the automated testing). Stupid me. The code I added conflicted with some code in mdb_t::mapctrl(). I just removed the code. It wasn't strictly necessary anyway. This should fix your problem, although I didn't try it out myself. eSk
mdb.cc.patch
(application/octet-stream, 1.4 KB)
Index: src/generic/mdb.cc
===================================================================
RCS file: /home/cvs/pistachio/kernel/src/generic/mdb.cc,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- src/generic/mdb.cc 12 Jun 2006 17:07:07 -0000 1.13
+++ src/generic/mdb.cc 21 Jun 2006 15:17:56 -0000 1.14
@@ -26,7 +26,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $Id: mdb.cc,v 1.13 2006/06/12 17:07:07 skoglund Exp $
+ * $Id: mdb.cc,v 1.14 2006/06/21 15:17:56 skoglund Exp $
*
********************************************************************/
#include <mdb.h>
@@ -122,32 +122,6 @@
ASSERT (table->get_node (addr) == node);
table->set_node (addr, node->get_next ());
-
- // Delete tables that fall empty. And continue to delete the
- // parent tables if they also fall empty. However, don't
- // delete an initial table hanging underneath a root node.
-
- while (table && table->get_count () == 0 &&
- (p->get_depth () > 0 || p->get_table () != table))
- {
- mdb_table_t * tt = p->get_table ();
- mdb_table_t * pt = NULL;
-
- while (tt->get_objsize () > table->get_objsize ())
- {
- pt = tt;
- tt = tt->get_table (addr);
- ASSERT (tt);
- }
-
- if (pt == NULL)
- node->remove_table ();
- else
- pt->remove_table (addr);
-
- delete table;
- table = pt;
- }
}
if (node->get_next ())