[Bug malloc/18505] New: sysmalloc delete newly created heap

[Bug malloc/18505] New: sysmalloc delete newly created heap

[ma.jiang at zte dot com.cn]

https://sourceware.org/bugzilla/show_bug.cgi?id=18505

            Bug ID: 18505
           Summary: sysmalloc  delete newly created heap
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: ma.jiang at zte dot com.cn
  Target Milestone: ---

Hi all,
   There is a bug in sysmalloc, which will slow down memory allocation.
   In the "if ((heap = new_heap (nb + (MINSIZE + sizeof (*heap)),
mp_.top_pad)))" branch. " top (av) = chunk_at_offset (heap, sizeof (*heap));"
set the av->top to the newly created heap. Then "if (old_size >= MINSIZE)" we
will call " _int_free (av, old_top, 1);". _int_free will call heap_trim at the
end. In heap_trim, becasue "top_chunk == chunk_at_offset(heap, sizeof(*heap))"
is true(we just set av->top to the newly created heap...), the newly created
heap was deleted and topchunk was moved to oldtop.
   Although we can probably get the memory from main_arena later(__libc_malloc
will retry if failed), this bug slow down allocation, and should be fixed.
   In my opinion, _int_free should be called after the final allocation have
been done.Just add a new bool variable need_free_oldtop, replace all call to
_int_free with need_free_oldtop=true, add a line "if (need_free_oldtop)
_int_free(av, old_top, 1);" just before "return chunk2mem (p);". This should be
enough for the bug.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/18505] sysmalloc delete newly created heap

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18505

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.