demo: fix stack corruption in ping_pong demo - #96
corytodd wants to merge 1 commit into
Conversation
Sorry, something went wrong.
While running the ping_pong demo I noticed a crash: ping_pong_1-1 | [ros2run]: Aborted ping_pong_1-1 | [INFO] [1775242528.757714440] []: Created a timer with period 2000 ms. ping_pong_1-1 | ping_pong_2-1 | realloc(): invalid old size ping_pong_1-1 | mremap_chunk(): invalid pointer ping_pong_2-1 | [ros2run]: Aborted ping_pong_1-1 | [ros2run]: Aborted This is caused by stack memory being passed to realloc() at https://github.com/ros2/rosidl/blob/8cdfe315157f8bffa9b73b6750c52f44325a7847/rosidl_runtime_c/src/string_functions.c#L110 Use ros string allocators to handle this safely. The outcoming_ping is sprintf'd so we must preallocate. Signed-off-by: Cory Todd <cory@219design.com>
|
Hi @corytodd, thanks for raising this and for taking the time to contribute a fix. However, I have been checking the trace from #95, and I am not sure this problem comes from the demo. In this part of the trace: ping_pong_debug-1 | #9 0x00007ffff7c8c044 in rosidl_runtime_c__String__assignn () from /opt/ros/humble/lib/librosidl_runtime_c.so ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #10 0x00007ffff28ba576 in _Header__cdr_deserialize () from /ros2_ws/install/std_msgs/lib/libstd_msgs__rosidl_typesupport_fastrtps_c.so ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #11 0x00007ffff783fbb9 in ?? () from /opt/ros/humble/lib/librmw_fastrtps_cpp.so ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #12 0x00007ffff77f0226 in rmw_fastrtps_shared_cpp::TypeSupport::deserialize(eprosima::fastrtps::rtps::SerializedPayload_t*, void*) () from /opt/ros/humble/lib/librmw_fastrtps_shared_cpp.so ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #13 0x00007ffff75f51aa in ?? () from /opt/ros/humble/lib/libfastrtps.so.2.6 ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #14 0x00007ffff727acb2 in eprosima::fastdds::dds::DataReaderImpl::read_or_take(eprosima::fastdds::dds::LoanableCollection&, eprosima::fastdds::dds::LoanableSequence<eprosima::fastdds::dds::SampleInfo, std::integral_constant<bool, true> >&, int, eprosima::fastrtps::rtps::InstanceHandle_t const&, unsigned short, unsigned short, unsigned short, bool, bool, bool) () from /opt/ros/humble/lib/libfastrtps.so.2.6 ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #15 0x00007ffff727ae5a in eprosima::fastdds::dds::DataReaderImpl::take(eprosima::fastdds::dds::LoanableCollection&, eprosima::fastdds::dds::LoanableSequence<eprosima::fastdds::dds::SampleInfo, std::integral_constant<bool, true> >&, int, unsigned short, unsigned short, unsigned short) () from /opt/ros/humble/lib/libfastrtps.so.2.6 ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #16 0x00007ffff77e77b6 in rmw_fastrtps_shared_cpp::_take(char const*, rmw_subscription_s const*, void*, bool*, rmw_message_info_s*, rmw_subscription_allocation_s*) () from /opt/ros/humble/lib/librmw_fastrtps_shared_cpp.so ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #17 0x00007ffff7f6048a in rcl_take () from /opt/ros/humble/lib/librcl.so ping_pong_debug-1 | No symbol table info available. ping_pong_debug-1 | #18 0x00007ffff7fa9923 in _rclc_take_new_data () from /ros2_ws/install/rclc/lib/librclc.so The line #10 is the telling one, std_msgs was built in your workspace, but it produced libstd_msgs__rosidl_typesupport_fastrtps_c.so. That suggests rmw_microxrcedds was not in the workspace when the interface packages were generated, so no micro-XRCE-DDS typesupport was created and the nodes fell back to the default Fast DDS RMW. This matters because the two stacks have different memory contracts. Micro-ROS targets microcontrollers where dynamic allocation is avoided, so rosidl_typesupport_microxrcedds never allocates: it deserializes straight into the buffer the application provides, bounded by capacity. The fixed char[STRING_BUFFER_LEN] buffers in the demo are deliberate for that reason. If an incoming string does not fit, Micro-CDR rejects it at the length header before copying anything; the generated code then sets size = 0, skips the payload to keep the rest of the message aligned, and the deserialization reports failure, so rmw_take returns RMW_RET_ERROR and the sample is dropped. No realloc is ever involved. Could you share how the workspace was created? Was it built with micro_ros_setup, and was RMW_IMPLEMENTATION set to rmw_microxrcedds at build time? Note also that micro_ros_demos_rclc declares rmw_microxrcedds and microxrcedds_client in its package.xml, and the demos are meant to run against a micro-ROS-Agent. Are you sure you set up your workspace for micro-ROS and run the micro-ROS-Agent correctly at the time of running the demo? |
Sorry, something went wrong.
|
You're 100% correct! I did use the micro-ros-agent base image for my workspace and called micro_ros_setup but failed to link the actual binaries to the correct DDS library. I see this now. I thought it was odd that there was dynamic allocation going on on the Linux build. I should have questioned that more carefully. Setting RMW_IMPLEMENTATION to rmw_microxrcedds is what I missed. Thanks for your patience. |
Sorry, something went wrong.
While running the ping_pong demo I noticed a crash:
ping_pong_1-1 | [ros2run]: Aborted
ping_pong_1-1 | [INFO] [1775242528.757714440] []: Created a timer with period 2000 ms. ping_pong_1-1 |
ping_pong_2-1 | realloc(): invalid old size
ping_pong_1-1 | mremap_chunk(): invalid pointer
ping_pong_2-1 | [ros2run]: Aborted
ping_pong_1-1 | [ros2run]: Aborted
This is caused by stack memory being passed to realloc() at https://github.com/ros2/rosidl/blob/8cdfe315157f8bffa9b73b6750c52f44325a7847/rosidl_runtime_c/src/string_functions.c#L110
Use ros string allocators to handle this safely. The outcoming_ping is sprintf'd so we must preallocate.
After patching my tree I see the expected output
Fixes #95
Signed-off-by: Cory Todd cory@219design.com