FRTOS_ERR_QUEUE_CORRUPT embedded runtime_error ai_generated true

FreeRTOS: Queue send failed due to internal corruption, pxQueue->uxMessagesWaiting = 0xDEAD

ID: embedded/freertos-queue-overflow-corruption

Also available as: JSON · Markdown · 中文
75%Fix Rate
90%Confidence
1Evidence
2024-06-12First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
FreeRTOS v10.4.6 active — — —
ARM GCC v12.2.1 active — — —

Root Cause

Memory corruption in the queue control block, often caused by a buffer overflow or use-after-free in another task.

generic

中文

队列控制块内存损坏，通常由其他任务的缓冲区溢出或释放后使用导致。

Official Documentation

https://www.freertos.org/implementation/a00011.html

Workarounds

  1. 70% success Add assertions to check queue integrity before each send: `configASSERT(pxQueue->uxMessagesWaiting <= pxQueue->uxLength);` and debug the memory overwrite source 
    Add assertions to check queue integrity before each send: `configASSERT(pxQueue->uxMessagesWaiting <= pxQueue->uxLength);` and debug the memory overwrite source
  2. 85% success Use a memory protection unit (MPU) to guard queue control block memory, e.g., `mpu_set_region(MPU_REGION_QUEUE, (uint32_t)queue_cb, MPU_RW_PRIVILEGED);` 
    Use a memory protection unit (MPU) to guard queue control block memory, e.g., `mpu_set_region(MPU_REGION_QUEUE, (uint32_t)queue_cb, MPU_RW_PRIVILEGED);`

中文步骤

  1. Add assertions to check queue integrity before each send: `configASSERT(pxQueue->uxMessagesWaiting <= pxQueue->uxLength);` and debug the memory overwrite source
  2. Use a memory protection unit (MPU) to guard queue control block memory, e.g., `mpu_set_region(MPU_REGION_QUEUE, (uint32_t)queue_cb, MPU_RW_PRIVILEGED);`

Dead Ends

Common approaches that don't work:

  1. 80% fail

    Increasing queue length does not fix memory corruption; the control block is still overwritten by the same bug.

  2. 75% fail

    Timing changes may mask the corruption temporarily but do not eliminate the root cause (e.g., buffer overflow).