OSMemPut allows cross-partition free leading to free list corruption (Type: robustness enhancement)

[fuzzrt26]

(kernel version v3.08)

Summary

OSMemPut() does not verify that the memory block belongs to the target partition. This allows a block allocated from one partition to be returned to another, corrupting the internal free list.

Details

In os_mem.c, OSMemPut() inserts p_blk into the partition free list without validating its origin:

*(void **)p_blk = p_mem->FreeListPtr;
p_mem->FreeListPtr = p_blk;
p_mem->NbrFree++;

There is no check that p_blk lies within the memory range of p_mem.

Reproduction

OSMemCreate(&memA, ..., bufA, 4, 8, &err);
OSMemCreate(&memB, ..., bufB, 4, 8, &err);

void *blk = OSMemGet(&memA, &err);

/* Not rejected */
OSMemPut(&memB, blk, &err);

/* Returns memory from memA */
void *blk2 = OSMemGet(&memB, &err);

Impact

Free list corruption, Cross-partition memory aliasing, Undefined behavior in subsequent allocations

No error is reported, making the issue hard to detect.

Suggested enhancement

Add a range check before inserting the block:

if ((p_blk < p_mem->AddrPtr) ||
    (p_blk >= (p_mem->AddrPtr + p_mem->NbrMax * p_mem->BlkSize))) {
    *p_err = OS_ERR_MEM_INVALID_P_BLK;
    return;
}

Notes:

This may be considered invalid API usage, but adding a lightweight check (e.g., under OS_CFG_ARG_CHK_EN) would significantly improve robustness.