Assert on event use after free

Author: adel-mamin

Doxyfile.in

@@ -38,6 +38,8 @@ EXCLUDE_SYMBOLS        = AM_ASSERT_STATIC \
                          AM_EVENT_TICK_DOMAIN_MASK \
                          AM_EVENT_POOL_INDEX_BITS \
                          AM_EVENT_POOL_INDEX_MASK \
+                         AM_EVENT_ID_LSW_BITS \
+                         AM_EVENT_ID_LSW_MASK \
                          am_alignof_slist \
                          am_alignof_slist_item \
                          AM_ALIGNOF_SLIST \

libs/event/event.c

@@ -119,6 +119,7 @@ struct am_event *am_event_allocate_x(int id, int size, int margin) {
 
         memset(event, 0, sizeof(*event));
         event->id = id;
+        event->id_lsw = (uint32_t)id & AM_EVENT_ID_LSW_MASK;
         event->pool_index_plus_one =
             (unsigned)(i + 1) & AM_EVENT_POOL_INDEX_MASK;
 
@@ -142,6 +143,12 @@ static void am_event_free_unsafe(const struct am_event **event) {
 
     struct am_event *e = AM_CAST(struct am_event *, *event);
     AM_ASSERT(e->pool_index_plus_one <= AM_EVENT_POOLS_NUM_MAX);
+    /*
+     * Check if event is valid.
+     * If the below assert hits, then the reason is likely
+     * a use after free condition.
+     */
+    AM_ASSERT(((uint32_t)e->id & AM_EVENT_ID_LSW_MASK) == e->id_lsw);
 
     if (e->ref_counter > 1) {
         --e->ref_counter;
@@ -203,6 +210,16 @@ struct am_event *am_event_dup_x(
     const struct am_event_state *me = &am_event_state_;
     AM_ASSERT(me->npools > 0);
     AM_ASSERT(event->id >= AM_EVT_USER);
+    if (!am_event_is_static(event)) {
+        /*
+         * Check if event is valid.
+         * If the below assert hits, then the reason is likely
+         * a use after free condition.
+         */
+        AM_ASSERT(
+            ((uint32_t)event->id & AM_EVENT_ID_LSW_MASK) == event->id_lsw
+        );
+    }
     AM_ASSERT(margin >= 0);
 
     struct am_event *dup = am_event_allocate_x(event->id, size, margin);
@@ -283,6 +300,12 @@ void am_event_inc_ref_cnt(const struct am_event *event) {
     }
 
     AM_ASSERT(event->ref_counter < AM_EVENT_REF_COUNTER_MASK);
+    /*
+     * Check if event is valid.
+     * If the below assert hits, then the reason is likely
+     * a use after free condition.
+     */
+    AM_ASSERT(((uint32_t)event->id & AM_EVENT_ID_LSW_MASK) == event->id_lsw);
 
     struct am_event *e = AM_CAST(struct am_event *, event);
     struct am_event_state *me = &am_event_state_;
@@ -331,6 +354,16 @@ static enum am_event_rc am_event_push_x(
     const int capacity = am_queue_get_capacity(queue);
     AM_ASSERT(margin < capacity);
     AM_ASSERT(push);
+    if (!am_event_is_static(event)) {
+        /*
+         * Check if event is valid.
+         * If the below assert hits, then the reason is likely
+         * a use after free condition.
+         */
+        AM_ASSERT(
+            ((uint32_t)event->id & AM_EVENT_ID_LSW_MASK) == event->id_lsw
+        );
+    }
 
     struct am_event *e = AM_CAST(struct am_event *, event);
     struct am_event_state *me = &am_event_state_;

libs/event/event.h

@@ -34,6 +34,7 @@
 #define AM_EVENT_H_INCLUDED
 
 #include <stdbool.h>
+#include <stdint.h>
 
 #include "common/compiler.h"
 #include "queue/queue.h"
@@ -83,6 +84,9 @@
 #define AM_EVENT_POOL_INDEX_BITS 5
 #define AM_EVENT_POOL_INDEX_MASK ((1U << AM_EVENT_POOL_INDEX_BITS) - 1U)
 
+#define AM_EVENT_ID_LSW_BITS 16
+#define AM_EVENT_ID_LSW_MASK ((1U << AM_EVENT_ID_LSW_BITS) - 1U)
+
 extern const int am_alignof_event;
 extern const int am_alignof_event_ptr;
 
@@ -105,19 +109,24 @@ enum am_event_rc {
 /** Event descriptor. */
 struct am_event {
     /** event ID */
-    int id;
+    int32_t id;
 
     /** reference counter */
-    unsigned ref_counter : AM_EVENT_REF_COUNTER_BITS;
+    uint32_t ref_counter : AM_EVENT_REF_COUNTER_BITS;
     /** if set to zero, then event is statically allocated */
-    unsigned pool_index_plus_one : AM_EVENT_POOL_INDEX_BITS;
+    uint32_t pool_index_plus_one : AM_EVENT_POOL_INDEX_BITS;
     /** tick domain for time events */
-    unsigned tick_domain : AM_EVENT_TICK_DOMAIN_BITS;
+    uint32_t tick_domain : AM_EVENT_TICK_DOMAIN_BITS;
     /** PUB/SUB time event */
-    unsigned pubsub_time : 1;
+    uint32_t pubsub_time : 1;
+    /**
+     * Least significant word of id for allocated events.
+     * Used for sanity checks.
+     */
+    uint32_t id_lsw : AM_EVENT_ID_LSW_BITS;
 };
 
-AM_ASSERT_STATIC(sizeof(struct am_event) == (2 * sizeof(int)));
+AM_ASSERT_STATIC(sizeof(struct am_event) == (2 * sizeof(int32_t)));
 
 /** Event library state configuration. */
 struct am_event_state_cfg {