[riot-notifications] [RIOT] no memory left in handle_packet_fragment - when there still is plenty of memory left (#299)

benpicco notifications at github.com
Tue Nov 5 00:24:52 CET 2013


There are several strange things about the custom list implementation in lowpan.c:

e.g. in `check_timeout()` (https://github.com/RIOT-OS/RIOT/blob/master/sys/net/sixlowpan/lowpan.c#L634)

What happens when temp_buf points to head and gets freed - head will now still point to the old, invalid location.
Actually, head is never updated it seems.

That would explain why it leaks memory and occasionally crashes.
e.g. assuming the following list:

      head
        |
        v
    [expired] -> [valid] -> [valid]

after collect_garbage()

      head
        |
        v
      null     [valid] -> [valid]

I guess the original intention was that new packets are always added to the head, so only the tail expires, but looking at https://github.com/RIOT-OS/RIOT/blob/master/sys/net/sixlowpan/lowpan.c#L422 shows that this is not true.

---
Reply to this email directly or view it on GitHub:
https://github.com/RIOT-OS/RIOT/issues/299#issuecomment-27733524
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riot-os.org/pipermail/notifications/attachments/20131104/cf872870/attachment.html>


More information about the notifications mailing list