[Bug malloc/17924] New: 'free' should not set errno

[Bug malloc/17924] New: 'free' should not set errno

[eggert at gnu dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

            Bug ID: 17924
           Summary: 'free' should not set errno
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: eggert at gnu dot org

As mentioned in <http://austingroupbugs.net/view.php?id=385>, the next major
POSIX release will require 'free' to not set errno.  Rich Felker points out
some scenarios when glibc 'free' might set errno; see
<https://sourceware.org/ml/libc-alpha/2015-02/msg00067.html>.  These scenarios
should be investigated and fixed.

Also, the glibc documentation should be updated to make it clear to users that
glibc 'free' does not set errno, and that any replacements for 'free' should do
the same.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[bruno at clisp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

Bruno Haible <bruno at clisp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bruno at clisp dot org

--- Comment #2 from Bruno Haible <bruno at clisp dot org> ---
Created attachment 13064
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13064&action=edit
Test case for one of the scenarios

Find attached a test case for one of the scenarios, namely when
  1. free() invokes munmap() and
  2. munmap()'s attempt to split a VMA fails due to /proc/sys/vm/max_map_count.

It fails on glibc 2.3.2, 2.23, 2.28, 2.32,
as well as on musl libc 1.1.24.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[eggert at cs dot ucla.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

eggert at cs dot ucla.edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |eggert at cs dot ucla.edu

--- Comment #3 from eggert at cs dot ucla.edu ---
Created attachment 13065
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13065&action=edit
patch 'free' to preserve errno

Thanks for the test case, Bruno. Proposed glibc patch attached. It includes
your test case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[bruno at clisp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

--- Comment #4 from Bruno Haible <bruno at clisp dot org> ---
I believe there is also another code path that can lead to free() setting
errno.

Namely, when glibc is not configured with --disable-experimental-malloc,
USE_TCACHE gets defined and enables this code path:
__libc_free -> malloc.c:3147 -> MAYBE_INIT_TCACHE -> malloc.c:3033 ->
tcache_init -> malloc.c:3007 -> _int_malloc -> malloc.c:3580 -> sysmalloc

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[eggert at cs dot ucla.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

eggert at cs dot ucla.edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #13065|0                           |1
        is obsolete|                            |
           Assignee|unassigned at sourceware dot org   |eggert at cs dot ucla.edu
             Status|NEW                         |ASSIGNED

--- Comment #5 from eggert at cs dot ucla.edu ---
Created attachment 13067
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13067&action=edit
patch 'free' to preserve errno (take 2)

> I believe there is also another code path that can lead to free() setting errno.


Thanks, I'm attaching a superseding patch that should cover that code path as
well.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[eggert at cs dot ucla.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

eggert at cs dot ucla.edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #13067|0                           |1
        is obsolete|                            |

--- Comment #6 from eggert at cs dot ucla.edu ---
Created attachment 13071
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13071&action=edit
patch 'free' to preserve errno (take 3)

Here is v3 of the patch, reflecting comments from Siddhesh Poyarekar
<https://sourceware.org/pipermail/libc-alpha/2020-December/120892.html> and
from Carlos O'Donell
<https://sourceware.org/pipermail/libc-alpha/2020-December/120901.html>. I'll
also email this to libc-alpha.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[eggert at cs dot ucla.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

eggert at cs dot ucla.edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #13071|0                           |1
        is obsolete|                            |

--- Comment #7 from eggert at cs dot ucla.edu ---
Created attachment 13072
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13072&action=edit
patch 'free' to preserve errno (take 4)

This reflects comments from Florian Weimer
<https://sourceware.org/pipermail/libc-alpha/2020-December/120911.html> by
improving the test case. Also, it fixes the bug number in the commit message.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[eggert at cs dot ucla.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

eggert at cs dot ucla.edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #13072|0                           |1
        is obsolete|                            |

--- Comment #8 from eggert at cs dot ucla.edu ---
Created attachment 13073
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13073&action=edit
patch 'free' to preserve errno (take 5)

This reflects Adhemerval Zanella's comments
<https://sourceware.org/pipermail/libc-alpha/2020-December/121063.html> by
improving the test case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[eggert at cs dot ucla.edu]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

eggert at cs dot ucla.edu changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.33
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #9 from eggert at cs dot ucla.edu ---
I installed the patch after further review by Adhemerval Zanella, which
resulted in a couple of minor changes to the test case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/17924] 'free' should not set errno

[gabravier at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17924

Gabriel Ravier <gabravier at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |gabravier at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.