CCS/CC2652P: Exception on deallocation to memory

Egor Zmushko

Part Number: CC2652P

Tool/software: Code Composer Studio

simplelink_cc13x2_26x2_sdk_4_30_00_54

I have a problem while executing the OsalPort_msgDeallocate (pMsg->pBuf) function in NPITask_sendBufToStack ().
Exception often occurs due to an invalid address. In the debugger, I actually see a novalid address when executing OsalPort_MSG_ID (pMsg) (OsalPort_msgDeallocate () function).

I am confused about the order of freeing memory:
OsalPort_free (pMsg);
OsalPort_msgDeallocate (pMsg-> pBuf);
Isn't this a mistake?

static uint8_t NPITask_sendBufToStack( NPIMSG_msg_t *pMsg )
{
    uint8_t msgStatus = 0;

    mtOSALSerialData_t *pOsalMsg;

    uint8 *pReq = (uint8 *)pMsg->pBuf;

    /* Allocate memory for the MT message */
    pOsalMsg = (mtOSALSerialData_t *)OsalPort_msgAllocate( sizeof ( mtOSALSerialData_t ) );

    if (pOsalMsg)
    {
        /* Fill up what we can */
        pOsalMsg->hdr.event = CMD_SERIAL_MSG;

        pOsalMsg->msg = OsalPort_malloc( MT_RPC_FRAME_HDR_SZ + pReq[MT_RPC_POS_LEN] );

        if(pOsalMsg->msg) {

          memcpy(pOsalMsg->msg, pReq, (MT_RPC_FRAME_HDR_SZ + pReq[MT_RPC_POS_LEN]) );

          msgStatus = OsalPort_msgSend( MTServiceTaskID, (byte *)pOsalMsg );
        }

    }

    OsalPort_free(pMsg);
    OsalPort_msgDeallocate(pMsg->pBuf);

    return (msgStatus);
}

over 3 years ago

0 YiKai Chen over 3 years ago

Guru 735455 points

Which one do you see invalid address? pMsg or pMsg->pBuf? Do you see this trouble in original ZNP project?

0 Egor Zmushko over 3 years ago in reply to YiKai Chen

Prodigy 65 points

Hi, Chen!

I am working with the zigbee2mqtt project https://github.com/Koenkk/Z-Stack-firmware/tree/develop/coordinator/Z-Stack_3.x.0

In the original ZNP code, minor changes were made regarding the location of the I / O pins and working with the amplifier. I see an invalid address at the pMsg-> pBuf pointer. Each time this address is 0x1040b04.

0 YiKai Chen over 3 years ago in reply to Egor Zmushko

Guru 735455 points

Do you know which specific MT command causes this issue?

0 Egor Zmushko over 3 years ago in reply to YiKai Chen

Prodigy 65 points

I do not know this. If necessary, I can log mt commands.

The device can catch an exception a few hours after the restart, or it can work for about a week.
It seemed to me strange that at the beginning, a region of memory is freed where the pointer to memory is located, which will be freed further.

OsalPort_free (pMsg)
Can an interrupt occur at this moment in which pMsg memory will be allocated for another task?
OsalPort_msgDeallocate (pMsg-> pBuf);

0 YiKai Chen over 3 years ago in reply to Egor Zmushko

Guru 735455 points

From my point of view, “ OsalPort_msgDeallocate (pMsg-> pBuf);” should be put before “ OsalPort_free (pMsg)” and it’s better to check if it’s not invalid pointer before de allocate and free the pointer.

0 Egor Zmushko over 3 years ago in reply to YiKai Chen

Prodigy 65 points

That's exactly what I did. The device has been working normally for 8 days. Testing continues. Thanks for the help.

Hopefully this will be fixed in the next versions of the SDK.

0 daniel_o over 3 years ago in reply to Egor Zmushko

TI__Genius 10580 points

Egor,

Thank you for bringing this to our attention. I've alerted our development team and will file a bug report accordingly.

Regards,

Daniel

Zigbee & Thread

Zigbee & Thread forum

CCS/CC2652P: Exception on deallocation to memory