RT-Thread / RT-Thread/rt-thread
[Bug] Wrong MEM_POOL check in rt_smem_free
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 12.2k
- Forks
- 5.4k
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 40
Description
RT-Thread Version
master
Hardware Type/Architectures
all
Develop Toolchain
IAR
Describe the bug
Describe the bug
In rt_smem_free() (file: src/mem.c), the following assertion is used:
RT_ASSERT(MEM_POOL(&small_mem->heap_ptr[mem->next]) == small_mem);
This assertion fails incorrectly when freeing a block located near the heap end (heap_end).
At this point, the logic actually refers to the previous block (mem->prev), not mem->next.
Since the heap_end block is always marked as USED, MEM_POOL(...) does not equal small_mem, causing a false assertion failure.
How to reproduce
- Initialize rt_smem with a small heap.
- Allocate and free a block close to the heap_end.
- Observe assert failed inside rt_smem_free.
Expected behavior
Memory should be freed correctly without triggering a false assertion.
Root cause
- The assertion checks mem->next, which may point to the sentinel heap_end.
- heap_end is always USED, so MEM_POOL() fails.
- The check should instead validate mem->prev at this point.
Proposed fix
Change the assertion from mem->next to mem->prev.
This aligns the implementation with the original lwIP small memory allocator.
--- a/src/mem.c
+++ b/src/mem.c
@@ void rt_smem_free(void *rmem)
- RT_ASSERT(MEM_POOL(&small_mem->heap_ptr[mem->next]) == small_mem);
+ RT_ASSERT(MEM_POOL(&small_mem->heap_ptr[mem->prev]) == small_mem);
Environment
- RT-Thread version: [master branch]
- Module: components src/mem.c
- Target: [all]
Additional context
- Verified with test cases: issue reproduced on small heap allocation/free.
- After patch, allocator works without false assertion.
- Behavior now matches lwIP mem_free() / plug_holes().
Other additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/mem.c at rt_smem_free() and inspect the assertion involving small_mem->heap_ptr and the neighboring block pointers. Reproduce the issue with a small heap by allocating and freeing a block near heap_end; done means the free operation no longer triggers a false assertion and matches the described allocator behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot, operating-systems
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100