RT-Thread / RT-Thread/rt-thread

[Bug] Wrong MEM_POOL check in rt_smem_free

Open
#10,632 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
12.2k
Forks
5.4k
Avg merge
4d 12h
Merged PRs (30d)
40

Description

RT-Thread Version

master

Hardware Type/Architectures

all

Develop Toolchain

IAR

Describe the bug

Describe the bug
In rt_smem_free() (file: src/mem.c), the following assertion is used:
RT_ASSERT(MEM_POOL(&small_mem->heap_ptr[mem->next]) == small_mem);
This assertion fails incorrectly when freeing a block located near the heap end (heap_end).
At this point, the logic actually refers to the previous block (mem->prev), not mem->next.
Since the heap_end block is always marked as USED, MEM_POOL(...) does not equal small_mem, causing a false assertion failure.

How to reproduce

  • Initialize rt_smem with a small heap.
  • Allocate and free a block close to the heap_end.
  • Observe assert failed inside rt_smem_free.

Expected behavior
Memory should be freed correctly without triggering a false assertion.

Root cause

  • The assertion checks mem->next, which may point to the sentinel heap_end.
  • heap_end is always USED, so MEM_POOL() fails.
  • The check should instead validate mem->prev at this point.

Proposed fix
Change the assertion from mem->next to mem->prev.
This aligns the implementation with the original lwIP small memory allocator.

--- a/src/mem.c
+++ b/src/mem.c
@@ void rt_smem_free(void *rmem)
-    RT_ASSERT(MEM_POOL(&small_mem->heap_ptr[mem->next]) == small_mem);
+    RT_ASSERT(MEM_POOL(&small_mem->heap_ptr[mem->prev]) == small_mem);

Environment

  • RT-Thread version: [master branch]
  • Module: components src/mem.c
  • Target: [all]

Additional context

  • Verified with test cases: issue reproduced on small heap allocation/free.
  • After patch, allocator works without false assertion.
  • Behavior now matches lwIP mem_free() / plug_holes().
Other additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/mem.c at rt_smem_free() and inspect the assertion involving small_mem->heap_ptr and the neighboring block pointers. Reproduce the issue with a small heap by allocating and freeing a block near heap_end; done means the free operation no longer triggers a false assertion and matches the described allocator behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
embedded-iot, operating-systems
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.