sharpdisplay: Fix memory corruption across soft-reset #3497
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It was incorrect to NULL out the pointer to our heap allocated buffer in `reset`, because subsequent to framebuffer_reset, but while the heap was still active, we could call `get_bufinfo` again, leading to a fresh allocation on the heap that is about to be destroyed. Typical stack trace: ``` #1 0x0006c368 in sharpdisplay_framebuffer_get_bufinfo #2 0x0006ad6e in _refresh_display #3 0x0006b168 in framebufferio_framebufferdisplay_background #4 0x00069d22 in displayio_background adafruit#5 0x00045496 in supervisor_background_tasks adafruit#6 0x000446e8 in background_callback_run_all adafruit#7 0x00045546 in supervisor_run_background_tasks_if_tick adafruit#8 0x0005b042 in common_hal_neopixel_write adafruit#9 0x00044c4c in clear_temp_status adafruit#10 0x000497de in spi_flash_flush_keep_cache adafruit#11 0x00049a66 in supervisor_external_flash_flush adafruit#12 0x00044b22 in supervisor_flash_flush adafruit#13 0x0004490e in filesystem_flush adafruit#14 0x00043e18 in cleanup_after_vm adafruit#15 0x0004414c in run_repl adafruit#16 0x000441ce in main ``` When this happened -- which was inconsistent -- the display would keep some heap allocation across reset which is exactly what we need to avoid. NULLing the pointer in reconstruct follows what RGBMatrix does, and that code is a bit more battle-tested anyway. If I had a motivation for structuring the SharpMemory code differently, I can no longer recall it. Testing performed: Ran my complicated calculator program over multiple iterations without observing signs of heap corruption. Closes: adafruit#3473
ladyada
approved these changes
Oct 1, 2020
jepler
added a commit
to jepler/circuitpython
that referenced
this pull request
Oct 1, 2020
If `supervisor_start_terminal` is called twice in a row without `supervisor_stop_terminal`, it would lose track of a supervisor allocation. This can occur when setting the rotation of a display, including the way that a FramebufferDisplay sets rotation _AFTER_ initial construction, first with a stack like ``` #0 supervisor_start_terminal #1 in displayio_display_core_construct #2 in common_hal_framebufferio_framebufferdisplay_construct ``` and then with a stack like ``` #0 supervisor_start_terminal #1 in common_hal_framebufferio_framebufferdisplay_construct #2 in framebufferio_framebufferdisplay_make_new ``` .. without an intervening stop_terminal call. For reasons I didn't fully explore, this did not become a problem until the ability to re-allocate a freed supervisor allocation was implemented in adafruit#3482. Demonstrating the problem requires adafruit#3482 + adafruit#3497 + this PR.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It was incorrect to NULL out the pointer to our heap allocated buffer in
reset, because subsequent to framebuffer_reset, but while the heap was still active, we could callget_bufinfoagain, leading to a fresh allocation on the heap that is about to be destroyed.Typical stack trace:
When this happened -- which was inconsistent -- the display would keep some heap allocation across reset which is exactly what we need to avoid.
NULLing the pointer in reconstruct follows what RGBMatrix does, and that code is a bit more battle-tested anyway.
If I had a motivation for structuring the SharpMemory code differently, I can no longer recall it.
Testing performed: Restarted my complicated calculator program over 100 iterations without observing signs of heap corruption.
Closes: #3473