kivancsikert / ugly-duckling

Firmware for FarmHub devices
0 stars 0 forks source link

Heap corruption detected while handling command via MQTT #235

Open lptr opened 1 month ago

lptr commented 1 month ago

Got this while handling MQTT incoming message with 0.32.0-rc-3-15-g887dd3ef working on #175:

[-] 0.32.0-rc-3-15-g887dd3ef-dirty, WIFI: 10.180.1.138, uptime: 4128.2 s, RTC: OK, heap: 96.76 kB, CPU: 160 MHz, battery: 4.00 V
assert failed: block_merge_prev tlsf.c:469 (block_is_free(prev) && "prev block is not free though marked as such")
HINT: CORRUPT HEAP: heap metadata corrupted resulting in TLSF malfunction.
Make sure you are not making out of bound writing on the memory you allocate in your application.
Make sure you are not writing on freed memory.
For more information run 'idf.py docs -sp api-reference/system/heap_debug.html'.

Backtrace: 0x4037602e:0x3fcce0f0 0x4038178d:0x3fcce110 0x4038adb1:0x3fcce130 0x40388815:0x3fcce260 0x40388634:0x3fcce280 0x40376a5e:0x3fcce2a0 0x4038ae51:0x3fcce2c0 0x4204bcb5:0x3fcce2e0 0x4204bcc9:0x3fcce300 0x420171d4:0x3fcce320 0x42017201:0x3fcce340 0x4201722d:0x3fcce370 0x4203fd2d:0x3fcce3a0 0x4203fd6b:0x3fcce3f0 0x4203fd77:0x3fcce410 0x42012c23:0x3fcce430 0x42012c97:0x3fcce450 0x40382696:0x3fcce490
--- 0x4037602e: panic_abort at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/esp_system/panic.c:463
0x4038178d: esp_system_abort at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/esp_system/port/esp_system_chip.c:92
0x4038adb1: __assert_func at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/newlib/assert.c:80
0x40388815: block_merge_prev at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/heap/tlsf/tlsf.c:469 (discriminator 3)
 (inlined by) tlsf_free at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/heap/tlsf/tlsf.c:1203 (discriminator 3)
0x40388634: multi_heap_free_impl at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/heap/multi_heap.c:235
0x40376a5e: heap_caps_free at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/heap/heap_caps_base.c:70
0x4038ae51: free at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/newlib/heap.c:39
0x4204bcb5: String::invalidate() at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/managed_components/espressif__arduino-esp32/cores/esp32/WString.cpp:160 (discriminator 1)
0x4204bcc9: String::~String() at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/managed_components/espressif__arduino-esp32/cores/esp32/WString.cpp:144      
0x420171d4: farmhub::kernel::drivers::MqttDriver::OutgoingMessage::~OutgoingMessage() at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/main/kernel/drivers/MqttDriver.hpp:134
 (inlined by) void std::destroy_at<farmhub::kernel::drivers::MqttDriver::OutgoingMessage>(farmhub::kernel::drivers::MqttDriver::OutgoingMessage*) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/stl_construct.h:88
 (inlined by) void std::_Destroy<farmhub::kernel::drivers::MqttDriver::OutgoingMessage>(farmhub::kernel::drivers::MqttDriver::OutgoingMessage*) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/stl_construct.h:149
 (inlined by) auto std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}::operator()<farmhub::kernel::drivers::MqttDriver::OutgoingMessage&>(farmhub::kernel::drivers::MqttDriver::OutgoingMessage&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:471
 (inlined by) void std::__invoke_impl<void, std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}, farmhub::kernel::drivers::MqttDriver::OutgoingMessage&>(std::__invoke_other, std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}&&, farmhub::kernel::drivers::MqttDriver::OutgoingMessage&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/invoke.h:61
 (inlined by) std::enable_if<is_invocable_r_v<void, std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}, farmhub::kernel::drivers::MqttDriver::OutgoingMessage&>, void>::type std::__invoke_r<void, std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}, farmhub::kernel::drivers::MqttDriver::OutgoingMessage&>(std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}&&, farmhub::kernel::drivers::MqttDriver::OutgoingMessage&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/invoke.h:111
 (inlined by) std::__detail::__variant::__gen_vtable_impl<std::__detail::__variant::_Multi_array<void (*)(std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}&&, std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>&)>, std::integer_sequence<unsigned int, 0u> >::__visit_invoke(std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}&&, std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:1036
 (inlined by) decltype(auto) std::__do_visit<void, std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}, std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>&>(std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset()::{lambda(auto:1&&)#1}&&, std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:1791
0x42017201: std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::_M_reset() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:469 (discriminator 1)
0x4201722d: std::__detail::__variant::_Variant_storage<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~_Variant_storage() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:479
 (inlined by) std::__detail::__variant::_Copy_ctor_base<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~_Copy_ctor_base() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:553 
 (inlined by) std::__detail::__variant::_Move_ctor_base<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~_Move_ctor_base() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:590
 (inlined by) std::__detail::__variant::_Copy_assign_base<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~_Copy_assign_base() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:628
 (inlined by) std::__detail::__variant::_Move_assign_base<false, farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~_Move_assign_base() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:680
 (inlined by) std::__detail::__variant::_Variant_base<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~_Variant_base() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:734
 (inlined by) std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>::~variant() at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/variant:1408
 (inlined by) farmhub::kernel::Queue<std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription> >::pollIn(std::chrono::duration<unsigned long, std::ratio<1ll, 1000ll> >, std::function<void (std::variant<farmhub::kernel::drivers::MqttDriver::OutgoingMessage, farmhub::kernel::drivers::MqttDriver::Subscription>&)>) at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/main/kernel/Concurrent.hpp:117
0x4203fd2d: farmhub::kernel::drivers::MqttDriver::runEventLoop(farmhub::kernel::Task&) at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/main/kernel/drivers/MqttDriver.hpp:324 (discriminator 3)
0x4203fd6b: farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/main/kernel/drivers/MqttDriver.hpp:211
0x4203fd77: void std::__invoke_impl<void, farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}&, farmhub::kernel::Task&>(std::__invoke_other, farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}&, farmhub::kernel::Task&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/invoke.h:61
 (inlined by) std::enable_if<is_invocable_r_v<void, farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}&, farmhub::kernel::Task&>, void>::type std::__invoke_r<void, farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}&, farmhub::kernel::Task&>(farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}&, farmhub::kernel::Task&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/invoke.h:111
 (inlined by) std::_Function_handler<void (farmhub::kernel::Task&), farmhub::kernel::drivers::MqttDriver::MqttDriver(farmhub::kernel::drivers::WiFiDriver&, farmhub::kernel::drivers::MdnsDriver&, farmhub::kernel::drivers::MqttDriver::Config const&, String const&, bool, farmhub::kernel::StateSource&)::{lambda(farmhub::kernel::Task&)#1}::operator()(farmhub::kernel::Task&) const::{lambda(farmhub::kernel::Task&)#1}>::_M_invoke(std::_Any_data const&, farmhub::kernel::Task&) at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/std_function.h:290
0x42012c23: std::function<void (farmhub::kernel::Task&)>::operator()(farmhub::kernel::Task&) const at C:/tools/Espressif/tools/xtensa-esp-elf/esp-13.2.0_20240530/xtensa-esp-elf/xtensa-esp-elf/include/c++/13.2.0/bits/std_function.h:591
0x42012c97: farmhub::kernel::Task::executeTask(void*) at C:/Users/lptr/Workspace/kivancsi/ugly-duckling/main/kernel/Task.hpp:194
0x40382696: vPortTaskWrapper at C:/tools/Espressif/frameworks/esp-idf-v5.3.1/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:134
lptr commented 1 month ago

Isn't trivially reproducible.