when running under FreeRTOS SMP, the timer task can attempt to free the CYW43 async context's statically allocated timer #2687

New issue

Closed

opened 2025-10-01 00:26:25 -05:00 by vogon · 2 comments

vogon commented

2025-10-01 00:26:25 -05:00

(Migrated from github.com)

hey there. while running FreeRTOS SMP 11.2.0 on SDK version 2.2.0 with static allocation enabled, I ran into an issue where calling cyw43_arch_deinit from a FreeRTOS task would cause FreeRTOS to throw an assertion failure and hard fault:

assertion "( ( uint8_t * ) ( pxLink ) >= &( ucHeap[ 0 ] ) ) && ( ( uint8_t * ) ( pxLink ) <= &( ucHeap[ (128*1024) - 1 ] ) )" failed: file "/home/vogon/work/ais-epaper/build/freertos_kernel-src/portable/MemMang/heap_4.c", line 368, function: vPortFree

I think the series of events which precipitates this assertion failing are:

async_context_freertos_deinit calls xTimerDelete on the async context's associated timer, which enqueues an asynchronous timer delete command for the timer task.
async_context_freertos_deinit continues executing past the memset at the end of the function.
the timer task is scheduled and receives the command from async_context_freertos_deinit to delete the timer.
prvProcessReceivedCommands checks pxTimer->ucStatus, which has been cleared to 0, and decides the timer was dynamically allocated.
vPortFree notices that the statically-allocated timer isn't in a heap block and panics.

I've verified that commenting out the memset at the bottom of async_context_freertos_deinit (which seems to be redundant with a memset at the top of async_context_freertos_init) prevents the crash from happening.

I've uploaded a gist of the app I'm running (with all the commented-out code removed but otherwise not cleaned up), as well as my FreeRTOSConfig.h and CMakeLists.txt: https://gist.github.com/vogon/4c08fdd31a565609d02cb2534a4386bd

hey there. while running FreeRTOS SMP 11.2.0 on SDK version 2.2.0 with static allocation enabled, I ran into an issue where calling `cyw43_arch_deinit` from a FreeRTOS task would cause FreeRTOS to throw an assertion failure and hard fault: ``` assertion "( ( uint8_t * ) ( pxLink ) >= &( ucHeap[ 0 ] ) ) && ( ( uint8_t * ) ( pxLink ) <= &( ucHeap[ (128*1024) - 1 ] ) )" failed: file "/home/vogon/work/ais-epaper/build/freertos_kernel-src/portable/MemMang/heap_4.c", line 368, function: vPortFree ``` I think the series of events which precipitates this assertion failing are: 1) `async_context_freertos_deinit` calls `xTimerDelete` on the async context's associated timer, which enqueues an asynchronous timer delete command for the timer task. 2) `async_context_freertos_deinit` continues executing past the `memset` at the end of the function. 3) the timer task is scheduled and receives the command from `async_context_freertos_deinit` to delete the timer. 4) `prvProcessReceivedCommands` checks `pxTimer->ucStatus`, which has been cleared to 0, and decides the timer was dynamically allocated. 5) `vPortFree` notices that the statically-allocated timer isn't in a heap block and panics. I've verified that commenting out the memset at the bottom of `async_context_freertos_deinit` (which seems to be redundant with a memset at the top of `async_context_freertos_init`) prevents the crash from happening. I've uploaded a gist of the app I'm running (with all the commented-out code removed but otherwise not cleaned up), as well as my FreeRTOSConfig.h and CMakeLists.txt: https://gist.github.com/vogon/4c08fdd31a565609d02cb2534a4386bd

peterharperuk commented

2026-06-12 09:02:05 -05:00

(Migrated from github.com)

Thanks for the good analysis. I will remove the redundant memset. I also wait for the timer to no longer be active - I don't like leaving the function until we've done our best to make sure deinit has completed

kilograham commented

2026-06-29 12:14:32 -05:00

(Migrated from github.com)