From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qv1-xf35.google.com (mail-qv1-xf35.google.com [IPv6:2607:f8b0:4864:20::f35]) by sourceware.org (Postfix) with ESMTPS id AD60C384D153 for ; Thu, 20 Oct 2022 17:56:10 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org AD60C384D153 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-qv1-xf35.google.com with SMTP id u7so159630qvn.13 for ; Thu, 20 Oct 2022 10:56:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=ZY6zUct3+GMWykVFAFWplzr6MLXzApabJRMIyKMPeUw=; b=qfTnSVdY+S0kdnXEynbGH7RgwulhXKFPFKKLmU8ZIMV+IpV3AYyIV0kD736i/yMQyf ryRcx8D67fZnEarifxsT01v/ro8pV47XLqFBth0ZgROC0wZl2C1+7fC/bs45f21NWUok aJLDlZAAQBvATozr0z47fg49I2kS+iJyW/TYHUfacGOwTGdXfW3MX0cVy3Abjek6ciqp bOTNJFk5SsxPYY9ObPgjATc2MU/AnOWgznD6meo6VOqNvVkqz94t91AHfCS47qkgGoiT yrA+x/JiZOx7+yIL4q7owBhZGacYZlasIjQJ7+/ASNOxnllxQoAVmlU92UH5fDMhPWWF MeHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=ZY6zUct3+GMWykVFAFWplzr6MLXzApabJRMIyKMPeUw=; b=a3HPUJHb0ORU0+8n3kgOmHoqRicQGGbJsm9a4ZXdtBpt8laubSvNZkYR8qJGe9fsai nVLNMCkAj5CWRFnXHoJfxofi6pgzrukGZmF7xsF3yiHx2NnV0oPqwGXSoMIfW3riOyvU apGBRPwuY29c9yrZsub4qdjOLdLlUN/Lfl4/7WciBAc+Uw2IDihYNSknUebB91B/+FyF FOEECm1rM/WNlkI9MPofUKRAYwnEAL/dkvXFsinZbhPJyDgCt31LYR8P6/7lh46UTcOy K16VuE717ACVTGbi3oAGdR0k6rkVAmjkIEQlyIgeb4Y/MBM32s+88jMXWJTTLFjcBi26 ys3w== X-Gm-Message-State: ACrzQf3IguJSS8kIPqpPFe5aAxYNPjBNdcW+tkR8f4o9iVwhQru8mVDt ON2ohPd9mxc136YJYUYSpdYDmuPs7ymVAh1BBAdR6EFtwlo= X-Google-Smtp-Source: AMsMyM5g2AwxJoHsjVT8sAYWmkrXo3zIX3YYBgMsQPWDreyhBE3CmLl5o3uNfQiRwp0suwksOmsSuNA0XNn7HeXIvtw= X-Received: by 2002:ad4:5b89:0:b0:4b1:a22e:7d7f with SMTP id 9-20020ad45b89000000b004b1a22e7d7fmr12233192qvp.26.1666288570047; Thu, 20 Oct 2022 10:56:10 -0700 (PDT) MIME-Version: 1.0 From: David Milo Date: Thu, 20 Oct 2022 19:56:08 +0200 Message-ID: Subject: [PATCH] malloc: skip allocation retry when encountering faulty requests (bug 29709) To: libc-alpha@sourceware.org Content-Type: multipart/mixed; boundary="0000000000004ffbd105eb7b0ab7" X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: --0000000000004ffbd105eb7b0ab7 Content-Type: text/plain; charset="UTF-8" Steps to reproduce the (bug 29709): 1. build glibc without tcache (--disable-experimental-malloc) 2. create a multithreaded process 3. make an invalid request (> PTRDIFF_MAX) via malloc/memalign Step 3 then results in a second allocation attempt with a different arena. This behavior does not make much sense, since retrying with another arena wont fix the real issue - the invalid request size. Read (bug xx) for more information. This patch should fix the issue. I see two possible solutions for this problem: 1. let _int_malloc/_int_memalign set errno to EINVAL instead of ENOMEM when encountering a faulty request size. This way, we can check errno before starting a second allocation attempt. If errno is set to EINVAL, we know that there is an issue with the argument itself and a second attempt would not behave differently, even if we would switch arenas. 2. add an extra condition for the second allocation attempt. Only start a second attempt if following conditions are met - returned pointer is NULL - requested size is less or equals PTRDIFF_MAX - current arena pointer is not NULL In my opinion solution 1 is the better choice. It would make more sense if we set errno to EINVAL instead of ENOMEM whenever we deal with faulty requests, since EINVAL indicates that invalid arguments were passed to library functions. Nevertheless, I decided to go with solution 2 in order to avoid bigger changes in exposed library functions (malloc/memalign would then also be able to set EINVAL instead of only ENOMEM). Signed-off-by: David Milosevic --0000000000004ffbd105eb7b0ab7 Content-Type: application/octet-stream; name="bug29709.patch" Content-Disposition: attachment; filename="bug29709.patch" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_l9hd53mh0 RnJvbSBlOTM4ODY3YzNjMzM3MTUyNGMzZTgwMDgxNjliYTQ0ODNiYzI5MzY0IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBEYXZpZCBNaWxvc2V2aWMgPG1pbG9kMjA0OEBnbWFpbC5jb20+ CkRhdGU6IFRodSwgMjAgT2N0IDIwMjIgMTk6MjA6MzkgKzAyMDAKU3ViamVjdDogW1BBVENIXSBt YWxsb2M6IHNraXAgYWxsb2NhdGlvbiByZXRyeSB3aGVuIGVuY291bnRlcmluZyBmYXVsdHkgcmVx dWVzdHMgKGJ1ZyAyOTcwOSkKVG86IGxpYmMtYWxwaGFAc291cmNld2FyZS5vcmcKClN0ZXBzIHRv IHJlcHJvZHVjZSB0aGUgKGJ1ZyAyOTcwOSk6CgogICAgMS4gYnVpbGQgZ2xpYmMgd2l0aG91dCB0 Y2FjaGUgKC0tZGlzYWJsZS1leHBlcmltZW50YWwtbWFsbG9jKQogICAgMi4gY3JlYXRlIGEgbXVs dGl0aHJlYWRlZCBwcm9jZXNzCiAgICAzLiBtYWtlIGFuIGludmFsaWQgcmVxdWVzdCAoPiBQVFJE SUZGX01BWCkgdmlhIG1hbGxvYy9tZW1hbGlnbgoKU3RlcCAzIHRoZW4gcmVzdWx0cyBpbiBhIHNl Y29uZCBhbGxvY2F0aW9uIGF0dGVtcHQgd2l0aCBhIGRpZmZlcmVudCBhcmVuYS4gVGhpcwpiZWhh dmlvciBkb2VzIG5vdCBtYWtlIG11Y2ggc2Vuc2UsIHNpbmNlIHJldHJ5aW5nIHdpdGggYW5vdGhl ciBhcmVuYSB3b250IGZpeAp0aGUgcmVhbCBpc3N1ZSAtIHRoZSBpbnZhbGlkIHJlcXVlc3Qgc2l6 ZS4gUmVhZCAoYnVnIHh4KSBmb3IgbW9yZSBpbmZvcm1hdGlvbi4KClRoaXMgcGF0Y2ggc2hvdWxk IGZpeCB0aGUgaXNzdWUuIEkgc2VlIHR3byBwb3NzaWJsZSBzb2x1dGlvbnMgZm9yIHRoaXMgcHJv YmxlbToKCiAgICAxLiBsZXQgX2ludF9tYWxsb2MvX2ludF9tZW1hbGlnbiBzZXQgZXJybm8gdG8g RUlOVkFMIGluc3RlYWQgb2YgRU5PTUVNCiAgICAgICB3aGVuIGVuY291bnRlcmluZyBhIGZhdWx0 eSByZXF1ZXN0IHNpemUuIFRoaXMgd2F5LCB3ZSBjYW4gY2hlY2sKICAgICAgIGVycm5vIGJlZm9y ZSBzdGFydGluZyBhIHNlY29uZCBhbGxvY2F0aW9uIGF0dGVtcHQuIElmIGVycm5vIGlzCiAgICAg ICBzZXQgdG8gRUlOVkFMLCB3ZSBrbm93IHRoYXQgdGhlcmUgaXMgYW4gaXNzdWUgd2l0aCB0aGUg YXJndW1lbnQKICAgICAgIGl0c2VsZiBhbmQgYSBzZWNvbmQgYXR0ZW1wdCB3b3VsZCBub3QgYmVo YXZlIGRpZmZlcmVudGx5LCBldmVuCiAgICAgICBpZiB3ZSB3b3VsZCBzd2l0Y2ggYXJlbmFzLgoK ICAgIDIuIGFkZCBhbiBleHRyYSBjb25kaXRpb24gZm9yIHRoZSBzZWNvbmQgYWxsb2NhdGlvbiBh dHRlbXB0LiBPbmx5CiAgICAgICBzdGFydCBhIHNlY29uZCBhdHRlbXB0IGlmIGZvbGxvd2luZyBj b25kaXRpb25zIGFyZSBtZXQKCiAgICAgICAgIC0gcmV0dXJuZWQgcG9pbnRlciBpcyBOVUxMCiAg ICAgICAgIC0gcmVxdWVzdGVkIHNpemUgaXMgbGVzcyBvciBlcXVhbHMgUFRSRElGRl9NQVgKICAg ICAgICAgLSBjdXJyZW50IGFyZW5hIHBvaW50ZXIgaXMgbm90IE5VTEwKCkluIG15IG9waW5pb24g c29sdXRpb24gMSBpcyB0aGUgYmV0dGVyIGNob2ljZS4gSXQgd291bGQgbWFrZSBtb3JlIHNlbnNl CmlmIHdlIHNldCBlcnJubyB0byBFSU5WQUwgaW5zdGVhZCBvZiBFTk9NRU0gd2hlbmV2ZXIgd2Ug ZGVhbCB3aXRoCmZhdWx0eSByZXF1ZXN0cywgc2luY2UgRUlOVkFMIGluZGljYXRlcyB0aGF0IGlu dmFsaWQgYXJndW1lbnRzIHdlcmUKcGFzc2VkIHRvIGxpYnJhcnkgZnVuY3Rpb25zLgoKTmV2ZXJ0 aGVsZXNzLCBJIGRlY2lkZWQgdG8gZ28gd2l0aCBzb2x1dGlvbiAyIGluIG9yZGVyIHRvIGF2b2lk CmJpZ2dlciBjaGFuZ2VzIGluIGV4cG9zZWQgbGlicmFyeSBmdW5jdGlvbnMgKG1hbGxvYy9tZW1h bGlnbgp3b3VsZCB0aGVuIGFsc28gYmUgYWJsZSB0byBzZXQgRUlOVkFMIGluc3RlYWQgb2Ygb25s eSBFTk9NRU0pLgoKU2lnbmVkLW9mZi1ieTogRGF2aWQgTWlsb3NldmljIDxtaWxvZDIwNDhAZ21h aWwuY29tPgotLS0KIG1hbGxvYy9tYWxsb2MuYyB8IDkgKysrKystLS0tCiAxIGZpbGUgY2hhbmdl ZCwgNSBpbnNlcnRpb25zKCspLCA0IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL21hbGxvYy9t YWxsb2MuYyBiL21hbGxvYy9tYWxsb2MuYwppbmRleCAyYTYxYzhiNWVlLi5iOTFhODI1NThlIDEw MDY0NAotLS0gYS9tYWxsb2MvbWFsbG9jLmMKKysrIGIvbWFsbG9jL21hbGxvYy5jCkBAIC0zMjk5 LDExICszMjk5LDEyIEBAIF9fbGliY19tYWxsb2MgKHNpemVfdCBieXRlcykKICAgICB9CiAKICAg YXJlbmFfZ2V0IChhcl9wdHIsIGJ5dGVzKTsKLQogICB2aWN0aW0gPSBfaW50X21hbGxvYyAoYXJf cHRyLCBieXRlcyk7CisKICAgLyogUmV0cnkgd2l0aCBhbm90aGVyIGFyZW5hIG9ubHkgaWYgd2Ug d2VyZSBhYmxlIHRvIGZpbmQgYSB1c2FibGUgYXJlbmEKICAgICAgYmVmb3JlLiAgKi8KLSAgaWYg KCF2aWN0aW0gJiYgYXJfcHRyICE9IE5VTEwpCisKKyAgaWYgKCh2aWN0aW0gPT0gTlVMTCkgJiYg KGJ5dGVzIDw9IFBUUkRJRkZfTUFYKSAmJiAoYXJfcHRyICE9IE5VTEwpKQogICAgIHsKICAgICAg IExJQkNfUFJPQkUgKG1lbW9yeV9tYWxsb2NfcmV0cnksIDEsIGJ5dGVzKTsKICAgICAgIGFyX3B0 ciA9IGFyZW5hX2dldF9yZXRyeSAoYXJfcHRyLCBieXRlcyk7CkBAIC0zNTQxLDkgKzM1NDIsOSBA QCBfbWlkX21lbWFsaWduIChzaXplX3QgYWxpZ25tZW50LCBzaXplX3QgYnl0ZXMsIHZvaWQgKmFk ZHJlc3MpCiAgICAgfQogCiAgIGFyZW5hX2dldCAoYXJfcHRyLCBieXRlcyArIGFsaWdubWVudCAr IE1JTlNJWkUpOwotCiAgIHAgPSBfaW50X21lbWFsaWduIChhcl9wdHIsIGFsaWdubWVudCwgYnl0 ZXMpOwotICBpZiAoIXAgJiYgYXJfcHRyICE9IE5VTEwpCisKKyAgaWYgKChwID09IE5VTEwpICYm IChieXRlcyA8PSBQVFJESUZGX01BWCkgJiYgKGFyX3B0ciAhPSBOVUxMKSkKICAgICB7CiAgICAg ICBMSUJDX1BST0JFIChtZW1vcnlfbWVtYWxpZ25fcmV0cnksIDIsIGJ5dGVzLCBhbGlnbm1lbnQp OwogICAgICAgYXJfcHRyID0gYXJlbmFfZ2V0X3JldHJ5IChhcl9wdHIsIGJ5dGVzKTsKLS0gCjIu MzcuMwoK --0000000000004ffbd105eb7b0ab7--