gh-ARMmbed/mbed-crypto
Watch
1
0
Fork
You've already forked mbed-crypto
 0
Code Issues 36 Pull requests 1 Releases 7 Activity

Possible race in mbedtls_memory_buffer_alloc_status() #302

New issue
Open
opened 2019-10-16 14:31:36 -05:00 by maxgerhardt · 1 comment
maxgerhardt commented 2019-10-16 14:31:36 -05:00 (Migrated from github.com)

Description

  • Target: STM32L476RG (ARM Cortex-M4F)
  • Toolchain: gcc-arm-none-eabi 8.2.1
  • Tools: mbed-cli 1.10.1
  • mbed-os version: 5.12.1
  • mbedtls version: 2.7.6 (is however still present in newest version)

In a firmware of mine, I have observed a crash (HardFault) when printing the status of the memory buffer using the function mbedtls_memory_buffer_alloc_status(). The crash log is as follows:

[02][01][02][T][2019-10-16 10:30:08 / 1571221808152] Memory at thread end
Current use: 102 blocks / 12544 bytes, max: 126 blocks / 20916 bytes (total 24948 bytes), alloc / free: 3277775 / 3277687, total buffer len 28672

Block list
HDR:  PTR( 536917680), PREV(         0), NEXT( 536917928), ALLOC(1), SIZE(       216)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536917928), PREV( 536917680), NEXT( 536918216), ALLOC(1), SIZE(       256)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536918216), PREV( 536917928), NEXT( 536918668), ALLOC(1), SIZE(       420)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536918668), PREV( 536918216), NEXT( 536918872), ALLOC(1), SIZE(       172)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536918872), PREV( 536918668), NEXT( 536918952), ALLOC(1), SIZE(        48)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536918952), PREV( 536918872), NEXT( 536919032), ALLOC(1), SIZE(        48)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536919032), PREV( 536918952), NEXT( 536919068), ALLOC(1), SIZE(         4)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536919068), PREV( 536919032), NEXT( 536919408), ALLOC(1), SIZE(       308)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536919408), PREV( 536919068), NEXT( 536919852), ALLOC(1), SIZE(       412)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536919852), PREV( 536919408), NEXT( 536920056), ALLOC(1), SIZE(       172)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920056), PREV( 536919852), NEXT( 536920120), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920120), PREV( 536920056), NEXT( 536920184), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920184), PREV( 536920120), NEXT( 536920220), ALLOC(1), SIZE(         4)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920220), PREV( 536920184), NEXT( 536920708), ALLOC(1), SIZE(       456)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920708), PREV( 536920220), NEXT( 536920772), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920772), PREV( 536920708), NEXT( 536920976), ALLOC(1), SIZE(       172)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536920976), PREV( 536920772), NEXT( 536921040), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921040), PREV( 536920976), NEXT( 536921104), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921104), PREV( 536921040), NEXT( 536921140), ALLOC(1), SIZE(         4)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921140), PREV( 536921104), NEXT( 536921344), ALLOC(1), SIZE(       172)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921344), PREV( 536921140), NEXT( 536921408), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921408), PREV( 536921344), NEXT( 536921472), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921472), PREV( 536921408), NEXT( 536921536), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921536), PREV( 536921472), NEXT( 536921572), ALLOC(1), SIZE(         4)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536921572), PREV( 536921536), NEXT( 536925248), ALLOC(0), SIZE(      3644)
      FPREV( 536937688), FNEXT( 536936896)
HDR:  PTR( 536925248), PREV( 536921572), NEXT( 536925588), ALLOC(1), SIZE(       308)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536925588), PREV( 536925248), NEXT( 536925668), ALLOC(1), SIZE(        48)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536925668), PREV( 536925588), NEXT( 536925748), ALLOC(1), SIZE(        48)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536925748), PREV( 536925668), NEXT( 536925860), ALLOC(1), SIZE(        80)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536925860), PREV( 536925748), NEXT( 536925960), ALLOC(1), SIZE(        68)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536925960), PREV( 536925860), NEXT( 536926064), ALLOC(1), SIZE(        72)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536926064), PREV( 536925960), NEXT( 536926516), ALLOC(1), SIZE(       420)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536926516), PREV( 536926064), NEXT( 536927024), ALLOC(0), SIZE(       476)
      FPREV( 536932152), FNEXT( 536929784)
HDR:  PTR( 536927024), PREV( 536926516), NEXT( 536927468), ALLOC(1), SIZE(       412)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536927468), PREV( 536927024), NEXT( 536927808), ALLOC(1), SIZE(       308)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536927808), PREV( 536927468), NEXT( 536927872), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536927872), PREV( 536927808), NEXT( 536927908), ALLOC(1), SIZE(         4)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536927908), PREV( 536927872), NEXT( 536927976), ALLOC(1), SIZE(        36)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536927976), PREV( 536927908), NEXT( 536928040), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536928040), PREV( 536927976), NEXT( 536928104), ALLOC(1), SIZE(        32)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536928104), PREV( 536928040), NEXT( 536928140), ALLOC(1), SIZE(         4)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536928140), PREV( 536928104), NEXT( 536928240), ALLOC(1), SIZE(        68)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536928240), PREV( 536928140), NEXT( 536928280), ALLOC(1), SIZE(         8)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536928280), PREV( 536928240), NEXT( 536928324), ALLOC(1), SIZE(        12)
      FPREV(         0), FNEXT(         0)
HDR:  PTR( 536928324), PREV( 536928280), NEXT( 536928400), ALLOC(0), SIZE(        44)
      FPREV(         1), FNEXT( 536928240)
HDR:  PTR(        68), PREV( 134381637), NEXT( 134381637), ALLOC(134381637), SIZE( 134381637)
      FPREV( 134381637), FNEXT( 134381637)
HDR:  PTR( 134381637), PREV( 602932256), NEXT(4143448061), ALLOC(267913456), SIZE(   2098101)
      FPREV( 136315135), FNEXT( 117440701)

++ MbedOS Fault Handler ++

FaultType: HardFault

Context:
R0   : 20000844
R1   : 34000000
R2   : 00000000
R3   : 20000488
R4   : F6F7FFFD
R5   : 20000484
R6   : 00320377
R7   : 00007000
R8   : 20015CC0
R9   : 200058D4
R10  : 2000595C
R11  : 200058D8
R12  : 00000000
SP   : 100025A8
LR   : 0800DCAB
PC   : 0800DC5C
xPSR : 01010000
PSP  : 10002540
MSP  : 10007FC0
CPUID: 410FC241
HFSR : 40000000
MMFSR: 00000000
BFSR : 00000082
UFSR : 00000000
DFSR : 00000008
AFSR : 00000000
BFAR : F6F8000D
Mode : Thread
Priv : Privileged
Stack: PSP

-- MbedOS Fault Handler --



++ MbedOS Error Info ++
Error Status: 0x0 Code: 0 Module: 0
Error Message: Fault exception
Location: 0x0
Error Value: 0x0
Current Thread: � �  Id: 0x0 Entry: 0x0 StackSize: 0x0 StackMem: 0x0 SP: 0x0 
For more info, visit: https://mbed.com/s/error?error=0x00000000&tgt=DEV
-- MbedOS Error Info --

The firmware is fairly complex and features multiple threads doing handshakes or encrypting stuff. So it can definitely happen that there concurrent calls to the buffer allocation functions. However, I have also implemented the MBEDTLS_THREADING_ALT functions using the mbed-os provided Mutex class and called mbedtls_threading_set_alt() accordingly. This mutex layer works, I have tested it independently.

The crash takes place (by looking at the PC) at the last line

    mbedtls_fprintf( stderr, "HDR:  PTR(%10u), PREV(%10u), NEXT(%10u), "
                              "ALLOC(%u), SIZE(%10u)\n",
                      (size_t) hdr, (size_t) hdr->prev, (size_t) hdr->next,

Where it does a dereference of the hdr pointer.

What you can see from the log is while printing the free list of the heap, it suddenly jumps to pointers it shouldn't. Note how there's there's a break from PTR( 536928324) to PTR( 68) (with an allocation size which exceeds the amount of memory the device has).

HDR:  PTR( 536928324), PREV( 536928280), NEXT( 536928400), ALLOC(0), SIZE(        44)
      FPREV(         1), FNEXT( 536928240)
HDR:  PTR(        68), PREV( 134381637), NEXT( 134381637), ALLOC(134381637), SIZE( 134381637)
      FPREV( 134381637), FNEXT( 134381637)
HDR:  PTR( 134381637), PREV( 602932256), NEXT(4143448061), ALLOC(267913456), SIZE(   2098101)
      FPREV( 136315135), FNEXT( 117440701)

When looking at the code it seems to me that this is a race which occurs when calling mbedtls_memory_buffer_alloc_status(). All the allocation function lock the heap.mutex while modifying the heap (see e.g. buffer_alloc_calloc_mutexed()). however, the buffer alloc status function does not. It just iterates through the linked list and follows every pointer. This behavior is still in there in newest code.

github.com/ARMmbed/mbed-crypto@150d577780/library/memory_buffer_alloc.c (L509-L530)

Thus I think my observed crash was caused by a race in which a free() operation took place while printing the buffer, and thus it printed a correct NEXT pointer but when assigning cur = cur->next_free; the value was already modified to some other value.

I thus propse to add the following code at the beginning and end of the function:

#if defined(MBEDTLS_THREADING_C)
    if (mbedtls_mutex_lock(&heap.mutex) != 0) {
        return;
    }
#endif

[..]
#if defined(MBEDTLS_THREADING_C)
    mbedtls_mutex_unlock(&heap.mutex);
#endif

I have tried to reproduce this exact crash but haven't succeeded. Triggering / loosing this race seems to be quite hard, but as my log file shows, possible.

Issue request type

[ ] Question
[ ] Enhancement
[X] Bug
<!-- ************************************** WARNING ************************************** The ciarcom bot parses this header automatically. Any deviation from the template may cause the bot to automatically correct this header or may result in a warning message, requesting updates. Please ensure that nothing follows the Issue request type section, all issue details are within the Description section and no changes are made to the template format (as detailed below). ************************************************************************************* --> ### Description <!-- Required Add detailed description of what you are reporting. Good example: https://os.mbed.com/docs/latest/reference/workflow.html Things to consider sharing: - What target does this relate to? - What toolchain (name + version) are you using? - What tools (name + version - is it mbed-cli, online compiler or IDE) are you using? - What is the SHA of Mbed OS (git log -n1 --oneline)? - Steps to reproduce. (Did you publish code or a test case that exhibits the problem?) --> - Target: STM32L476RG (ARM Cortex-M4F) - Toolchain: gcc-arm-none-eabi 8.2.1 - Tools: mbed-cli 1.10.1 - mbed-os version: 5.12.1 - mbedtls version: 2.7.6 (is however still present in newest version) In a firmware of mine, I have observed a crash (HardFault) when printing the status of the memory buffer using the function `mbedtls_memory_buffer_alloc_status()`. The crash log is as follows: ``` [02][01][02][T][2019-10-16 10:30:08 / 1571221808152] Memory at thread end Current use: 102 blocks / 12544 bytes, max: 126 blocks / 20916 bytes (total 24948 bytes), alloc / free: 3277775 / 3277687, total buffer len 28672 Block list HDR: PTR( 536917680), PREV( 0), NEXT( 536917928), ALLOC(1), SIZE( 216) FPREV( 0), FNEXT( 0) HDR: PTR( 536917928), PREV( 536917680), NEXT( 536918216), ALLOC(1), SIZE( 256) FPREV( 0), FNEXT( 0) HDR: PTR( 536918216), PREV( 536917928), NEXT( 536918668), ALLOC(1), SIZE( 420) FPREV( 0), FNEXT( 0) HDR: PTR( 536918668), PREV( 536918216), NEXT( 536918872), ALLOC(1), SIZE( 172) FPREV( 0), FNEXT( 0) HDR: PTR( 536918872), PREV( 536918668), NEXT( 536918952), ALLOC(1), SIZE( 48) FPREV( 0), FNEXT( 0) HDR: PTR( 536918952), PREV( 536918872), NEXT( 536919032), ALLOC(1), SIZE( 48) FPREV( 0), FNEXT( 0) HDR: PTR( 536919032), PREV( 536918952), NEXT( 536919068), ALLOC(1), SIZE( 4) FPREV( 0), FNEXT( 0) HDR: PTR( 536919068), PREV( 536919032), NEXT( 536919408), ALLOC(1), SIZE( 308) FPREV( 0), FNEXT( 0) HDR: PTR( 536919408), PREV( 536919068), NEXT( 536919852), ALLOC(1), SIZE( 412) FPREV( 0), FNEXT( 0) HDR: PTR( 536919852), PREV( 536919408), NEXT( 536920056), ALLOC(1), SIZE( 172) FPREV( 0), FNEXT( 0) HDR: PTR( 536920056), PREV( 536919852), NEXT( 536920120), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536920120), PREV( 536920056), NEXT( 536920184), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536920184), PREV( 536920120), NEXT( 536920220), ALLOC(1), SIZE( 4) FPREV( 0), FNEXT( 0) HDR: PTR( 536920220), PREV( 536920184), NEXT( 536920708), ALLOC(1), SIZE( 456) FPREV( 0), FNEXT( 0) HDR: PTR( 536920708), PREV( 536920220), NEXT( 536920772), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536920772), PREV( 536920708), NEXT( 536920976), ALLOC(1), SIZE( 172) FPREV( 0), FNEXT( 0) HDR: PTR( 536920976), PREV( 536920772), NEXT( 536921040), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536921040), PREV( 536920976), NEXT( 536921104), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536921104), PREV( 536921040), NEXT( 536921140), ALLOC(1), SIZE( 4) FPREV( 0), FNEXT( 0) HDR: PTR( 536921140), PREV( 536921104), NEXT( 536921344), ALLOC(1), SIZE( 172) FPREV( 0), FNEXT( 0) HDR: PTR( 536921344), PREV( 536921140), NEXT( 536921408), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536921408), PREV( 536921344), NEXT( 536921472), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536921472), PREV( 536921408), NEXT( 536921536), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536921536), PREV( 536921472), NEXT( 536921572), ALLOC(1), SIZE( 4) FPREV( 0), FNEXT( 0) HDR: PTR( 536921572), PREV( 536921536), NEXT( 536925248), ALLOC(0), SIZE( 3644) FPREV( 536937688), FNEXT( 536936896) HDR: PTR( 536925248), PREV( 536921572), NEXT( 536925588), ALLOC(1), SIZE( 308) FPREV( 0), FNEXT( 0) HDR: PTR( 536925588), PREV( 536925248), NEXT( 536925668), ALLOC(1), SIZE( 48) FPREV( 0), FNEXT( 0) HDR: PTR( 536925668), PREV( 536925588), NEXT( 536925748), ALLOC(1), SIZE( 48) FPREV( 0), FNEXT( 0) HDR: PTR( 536925748), PREV( 536925668), NEXT( 536925860), ALLOC(1), SIZE( 80) FPREV( 0), FNEXT( 0) HDR: PTR( 536925860), PREV( 536925748), NEXT( 536925960), ALLOC(1), SIZE( 68) FPREV( 0), FNEXT( 0) HDR: PTR( 536925960), PREV( 536925860), NEXT( 536926064), ALLOC(1), SIZE( 72) FPREV( 0), FNEXT( 0) HDR: PTR( 536926064), PREV( 536925960), NEXT( 536926516), ALLOC(1), SIZE( 420) FPREV( 0), FNEXT( 0) HDR: PTR( 536926516), PREV( 536926064), NEXT( 536927024), ALLOC(0), SIZE( 476) FPREV( 536932152), FNEXT( 536929784) HDR: PTR( 536927024), PREV( 536926516), NEXT( 536927468), ALLOC(1), SIZE( 412) FPREV( 0), FNEXT( 0) HDR: PTR( 536927468), PREV( 536927024), NEXT( 536927808), ALLOC(1), SIZE( 308) FPREV( 0), FNEXT( 0) HDR: PTR( 536927808), PREV( 536927468), NEXT( 536927872), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536927872), PREV( 536927808), NEXT( 536927908), ALLOC(1), SIZE( 4) FPREV( 0), FNEXT( 0) HDR: PTR( 536927908), PREV( 536927872), NEXT( 536927976), ALLOC(1), SIZE( 36) FPREV( 0), FNEXT( 0) HDR: PTR( 536927976), PREV( 536927908), NEXT( 536928040), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536928040), PREV( 536927976), NEXT( 536928104), ALLOC(1), SIZE( 32) FPREV( 0), FNEXT( 0) HDR: PTR( 536928104), PREV( 536928040), NEXT( 536928140), ALLOC(1), SIZE( 4) FPREV( 0), FNEXT( 0) HDR: PTR( 536928140), PREV( 536928104), NEXT( 536928240), ALLOC(1), SIZE( 68) FPREV( 0), FNEXT( 0) HDR: PTR( 536928240), PREV( 536928140), NEXT( 536928280), ALLOC(1), SIZE( 8) FPREV( 0), FNEXT( 0) HDR: PTR( 536928280), PREV( 536928240), NEXT( 536928324), ALLOC(1), SIZE( 12) FPREV( 0), FNEXT( 0) HDR: PTR( 536928324), PREV( 536928280), NEXT( 536928400), ALLOC(0), SIZE( 44) FPREV( 1), FNEXT( 536928240) HDR: PTR( 68), PREV( 134381637), NEXT( 134381637), ALLOC(134381637), SIZE( 134381637) FPREV( 134381637), FNEXT( 134381637) HDR: PTR( 134381637), PREV( 602932256), NEXT(4143448061), ALLOC(267913456), SIZE( 2098101) FPREV( 136315135), FNEXT( 117440701) ++ MbedOS Fault Handler ++ FaultType: HardFault Context: R0 : 20000844 R1 : 34000000 R2 : 00000000 R3 : 20000488 R4 : F6F7FFFD R5 : 20000484 R6 : 00320377 R7 : 00007000 R8 : 20015CC0 R9 : 200058D4 R10 : 2000595C R11 : 200058D8 R12 : 00000000 SP : 100025A8 LR : 0800DCAB PC : 0800DC5C xPSR : 01010000 PSP : 10002540 MSP : 10007FC0 CPUID: 410FC241 HFSR : 40000000 MMFSR: 00000000 BFSR : 00000082 UFSR : 00000000 DFSR : 00000008 AFSR : 00000000 BFAR : F6F8000D Mode : Thread Priv : Privileged Stack: PSP -- MbedOS Fault Handler -- ++ MbedOS Error Info ++ Error Status: 0x0 Code: 0 Module: 0 Error Message: Fault exception Location: 0x0 Error Value: 0x0 Current Thread: � � Id: 0x0 Entry: 0x0 StackSize: 0x0 StackMem: 0x0 SP: 0x0 For more info, visit: https://mbed.com/s/error?error=0x00000000&tgt=DEV -- MbedOS Error Info -- ``` The firmware is fairly complex and features multiple threads doing handshakes or encrypting stuff. So it can definitely happen that there concurrent calls to the buffer allocation functions. However, I have also implemented the `MBEDTLS_THREADING_ALT` functions using the mbed-os provided `Mutex` class and called `mbedtls_threading_set_alt()` accordingly. This mutex layer works, I have tested it independently. The crash takes place (by looking at the `PC`) at the last line ```cpp mbedtls_fprintf( stderr, "HDR: PTR(%10u), PREV(%10u), NEXT(%10u), " "ALLOC(%u), SIZE(%10u)\n", (size_t) hdr, (size_t) hdr->prev, (size_t) hdr->next, ``` Where it does a dereference of the `hdr` pointer. What you can see from the log is while printing the free list of the heap, it suddenly jumps to pointers it shouldn't. Note how there's there's a break from `PTR( 536928324)` to `PTR( 68)` (with an allocation size which exceeds the amount of memory the device has). ``` HDR: PTR( 536928324), PREV( 536928280), NEXT( 536928400), ALLOC(0), SIZE( 44) FPREV( 1), FNEXT( 536928240) HDR: PTR( 68), PREV( 134381637), NEXT( 134381637), ALLOC(134381637), SIZE( 134381637) FPREV( 134381637), FNEXT( 134381637) HDR: PTR( 134381637), PREV( 602932256), NEXT(4143448061), ALLOC(267913456), SIZE( 2098101) FPREV( 136315135), FNEXT( 117440701) ``` When looking at the code it seems to me that this is a race which occurs when calling `mbedtls_memory_buffer_alloc_status()`. All the allocation function lock the `heap.mutex` while modifying the heap (see e.g. `buffer_alloc_calloc_mutexed()`). however, the buffer alloc status function does not. It just iterates through the linked list and follows every pointer. This behavior is still in there in newest code. https://github.com/ARMmbed/mbed-crypto/blob/150d5777802834f0b7084fad95b32ebbc1e75d16/library/memory_buffer_alloc.c#L509-L530 Thus I think my observed crash was caused by a race in which a `free()` operation took place while printing the buffer, and thus it printed a correct `NEXT` pointer but when assigning `cur = cur->next_free;` the value was already modified to some other value. I thus propse to add the following code at the beginning and end of the function: ```cpp #if defined(MBEDTLS_THREADING_C) if (mbedtls_mutex_lock(&heap.mutex) != 0) { return; } #endif [..] #if defined(MBEDTLS_THREADING_C) mbedtls_mutex_unlock(&heap.mutex); #endif ``` I have tried to reproduce this exact crash but haven't succeeded. Triggering / loosing this race seems to be quite hard, but as my log file shows, possible. ### Issue request type <!-- Required Please add only one X to one of the following types. Do not fill multiple types (split the issue otherwise.) Please note this is not a GitHub task list, indenting the boxes or changing the format to add a '.' or '*' in front of them would change the meaning incorrectly. The only changes to be made are to add a description text under the description heading and to add a 'x' to the correct box. --> [ ] Question [ ] Enhancement [X] Bug
ciarmcom commented 2019-10-16 15:37:07 -05:00 (Migrated from github.com)

Internal Jira reference: https://jira.arm.com/browse/IOTCRYPT-957

*Internal Jira reference: https://jira.arm.com/browse/IOTCRYPT-957*
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
development
master
renesas-RA
archive/20260929T231721Z-rescue/gilles-peskine-arm/psa-wrap-api
dev/gilles-peskine-arm/psa-wrap-api-1
dev/gilles-peskine-arm/psa-streamline_encodings-types_and_curves
dev/yanesca/iotcrypt-942
dev/gilles-peskine-arm/psa-key_derivation-relax_inputs
dev/gilles-peskine-arm/test_outcome_file-crypto-fix
dev/hanno-arm/asn1_traversal_api
test_outcome_file-crypto-fix
dev/dgreen-arm/fix-ecdsa-rng
dev/yanesca/submodule-everest-testing
dev/yanesca/everest-submodule-testing
dev/k-stachowiak/IOTCRYPT-791-merge
psa-api-1.0-beta
dev/Patater/tls-development-20190722
dev/gilles-peskine-arm/psa-se_driver-create_key
dev/gilles-peskine-arm/harvard-md
dev/mbedcrypto-for-mbedtls-3.0
dev/shared/secure-element
dev/Patater/cmake-subproject-fix
dev/gilles-peskine-arm/c99-tryout
dev/gilles-peskine-arm/havege-asan-crypto
dev/gilles-peskine-arm/check_params-test_without_function-crypto
dev/gilles-peskine-arm/oss-fuzz-fix-build-crypto
mbedcrypto-1.1
psa-crypto-api
psa-policy_alg2-poc
test-link-seedfile-02
test-link-seedfile
dev/patater/remove-non-crypto
dev/patater/tls-development-20190425
dev/patater/tls-development-20190417
dev/patater/dev-tls-20190328
dev/Patater/dev-2028-merge
mbedcrypto-1.0
dev/Patater/update-dev-tls-dev-crypto-merge-7
dev/Patater/update-dev-tls-dev-crypto-merge
dev/mpg/sibling-oid-backwards-deps
mbedcrypto-0.1.0-beta
dev/mbed-crypto-0.1.0-alpha
mbedcrypto-3.1.0+renesas.1
mbedcrypto-3.1.0+renesas.0
mbedcrypto-2.0.0+renesas.0
mbedcrypto-3.1.0
mbedcrypto-3.0.1
mbedcrypto-3.0.0
mbedcrypto-3.0.0d0
mbedcrypto-2.1.0d0
mbedcrypto-2.0.0
mbedcrypto-2.0.0d2
mbedcrypto-2.0.0d1
mbedcrypto-2.0.0d0
mbedcrypto-1.1.1
mbedcrypto-1.1.0
mbedcrypto-1.1.0d2
mbedcrypto-1.1.0d1
mbedcrypto-1.1.0d0
psa-crypto-api-1.0-beta3
psa-crypto-api-1.0-beta2
mbedcrypto-1.0.0d7
mbedcrypto-1.0.0
mbedcrypto-1.0.0d6
mbedcrypto-1.0.0d5
mbedcrypto-1.0.0d4
mbedcrypto-1.0.0d3
mbedcrypto-1.0.0d2
mbedcrypto-1.0.0d1
mbedcrypto-1.0.0d0
psa-crypto-api-1.0-beta1
mbedcrypto-0.1.0b2
mbedcrypto-0.1.0b
mbedcrypto-0.1.0a+driver-0.3
mbedcrypto-0.1.0a+driver
mbedcrypto-0.1.0a
Labels
Clear labels   
api-spec
Issue or PR about the PSA specifications

  
bug
Something isn't working

  
CLA requested

   
CLA valid

   
compliance
Discrepancy between the library and the PSA Crypto API specification

  
DO NOT MERGE
The PR is not intended to be merged (yet). Usually used for a review of worked in progress.

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
feature branch
This issue or PR is for a short-term feature branch which doesn't have its own label.

  
good first issue
Good for newcomers

  
HEADER FORMATTING ISSUE

   
help wanted
Extra attention is needed

  
Information

   
invalid
This doesn't seem right

  
Jira status: AWAITING REVIEW

   
Jira status: CLOSED

   
Jira status: DONE

   
Jira status: IN PROGRESS

   
Jira status: IN REVIEW

   
Jira status: OPEN

   
Jira status: REOPENED

   
Jira status: RESOLVED

   
mirrored

   
mirror internally

   
needs: backports
Needs backports to Mbed TLS branches

  
needs: ci
Needs a passing full CI run

  
needs: design review

   
needs: preceding PR
Requires another PR to be merged first

  
needs: review
The pull request is ready for review. This generally means that it has no known issues.

  
needs: work
The pull request needs rework before it can be merged.

  
notabug
The bug is not considered to be a defect, but by design.

  
open for community contribution

   
Product Backlog

   
question
Further information is requested

  
ready for merge
Design and code approved, CI passed, and likewise for backports. Label added by gatekeepers only.

  
security
Security expertise requested in review

  
stale
This PR is not being actively worked on. It can be considered abandoned work.

  
type: bug

   
type: enhancement

   
type: question

   
web pages
The /docs directory in the master branch is shown on https://armmbed.github.io/mbed-crypto

  
wontfix
The cost of fixing the bug or managing it in the bug list is not justified.

  
writing
Documentation wording and formatting

No labels
api-spec
bug
CLA requested
CLA valid
compliance
DO NOT MERGE
duplicate
enhancement
feature branch
good first issue
HEADER FORMATTING ISSUE
help wanted
Information
invalid
Jira status: AWAITING REVIEW
Jira status: CLOSED
Jira status: DONE
Jira status: IN PROGRESS
Jira status: IN REVIEW
Jira status: OPEN
Jira status: REOPENED
Jira status: RESOLVED
mirrored
mirror internally
needs: backports
needs: ci
needs: design review
needs: preceding PR
needs: review
needs: work
notabug
open for community contribution
Product Backlog
question
ready for merge
security
stale
type: bug
type: enhancement
type: question
web pages
wontfix
writing
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gh-ARMmbed/mbed-crypto#302
No description provided.