RE: Inconsistency between documentation and code in lib/alchemy/task.c

RE: Inconsistency between documentation and code in lib/alchemy/task.c

[Rosenow, James]

Greetings,

We are experiencing a crash in rt_task_inquire() and found an apparent inconsistency between the doc and the code.  Our code is passing a NULL 'info' pointer and subsequently crashing.  See code snipped below.

Best regards,
Jim Rosenow
MTS Systems Corporation

/**
* @fn int rt_task_inquire(RT_TASK *task, RT_TASK_INFO *info)
* @brief Retrieve information about a real-time task.
*

<<<<<<< snip >>>>>>>>

* @param info  The address of a structure the task information will be

                                         Passing NULL is supposed to be valid but
                                         below it is not checked before use.
                                          |
                                         \/
* written to. Passing NULL is valid, in which case the system is only
* probed for existence of the specified task.
*

<<<<<<< snip >>>>>>>>

*/
int rt_task_inquire(RT_TASK *task, RT_TASK_INFO *info)
{
                    struct alchemy_task *tcb;
                    struct service svc;
                    int ret = 0;

                    CANCEL_DEFER(svc);

                    tcb = get_alchemy_task_or_self(task, &ret);
                    if (tcb == NULL)
                                         goto out;

                                                                                                      'info' is not checked
                                                                                                      for NULL before
                                                                                                      dereference.
                                                                                                      |
                                                                                                     \/
                    ret = __bt(threadobj_stat(&tcb->thobj, &info->stat));
                    if (ret)
                                         goto out;

<<<<<<< snip >>>>>>>>

Re: Inconsistency between documentation and code in lib/alchemy/task.c

[Jan Kiszka]

On 22.02.23 17:32, Rosenow, James wrote:
> Greetings,
> 
> We are experiencing a crash in rt_task_inquire() and found an apparent inconsistency between the doc and the code.  Our code is passing a NULL 'info' pointer and subsequently crashing.  See code snipped below.
> 
> Best regards,
> Jim Rosenow
> MTS Systems Corporation
> 
> /**
> * @fn int rt_task_inquire(RT_TASK *task, RT_TASK_INFO *info)
> * @brief Retrieve information about a real-time task.
> *
> 
> <<<<<<< snip >>>>>>>>
> 
> * @param info  The address of a structure the task information will be
> 
>                                          Passing NULL is supposed to be valid but
>                                          below it is not checked before use.
>                                           |
>                                          \/
> * written to. Passing NULL is valid, in which case the system is only
> * probed for existence of the specified task.
> *
> 
> <<<<<<< snip >>>>>>>>
> 
> */
> int rt_task_inquire(RT_TASK *task, RT_TASK_INFO *info)
> {
>                     struct alchemy_task *tcb;
>                     struct service svc;
>                     int ret = 0;
> 
>                     CANCEL_DEFER(svc);
> 
>                     tcb = get_alchemy_task_or_self(task, &ret);
>                     if (tcb == NULL)
>                                          goto out;
> 
>                                                                                                       'info' is not checked
>                                                                                                       for NULL before
>                                                                                                       dereference.
>                                                                                                       |
>                                                                                                      \/
>                     ret = __bt(threadobj_stat(&tcb->thobj, &info->stat));
>                     if (ret)
>                                          goto out;
> 
> <<<<<<< snip >>>>>>>>
> 
> 
> 

We probably didn't read or forgot to update the documentation while
porting from Xenomai 2 to 3. Checking... Yeah, 2.x implemented this in
the kernel and did take care of this case. But already the first version
of rt_task_inquire in 3.x, now in userspace, got this wrong.

I'm fine with re-adding that feature to the code and taking that fix
into stable branches - want to send a patch for this more than 11 years
old bug?

Thanks,
Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux