* [PATCH] malloc: tcache: detect infinite-loop in _int_free when freeing tcache [BZ#27052]
@ 2020-12-11 14:06 W. Hashimoto
2020-12-11 22:04 ` DJ Delorie
0 siblings, 1 reply; 2+ messages in thread
From: W. Hashimoto @ 2020-12-11 14:06 UTC (permalink / raw)
To: libc-alpha; +Cc: W. Hashimoto
If linked-list of tcache contains a loop, it invokes infinite
loop in _int_free when freeing tcache. The PoC which invokes
such infinite loop is on the Bugzilla(#27052). This loop
should terminate when the loop exceeds mp_.tcache_count and
the program should abort. The affected glibc version is
2.29 or later.
---
malloc/malloc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 5b87bdb081..aadae327bf 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4224,11 +4224,14 @@ _int_free (mstate av, mchunkptr p, int have_lock)
if (__glibc_unlikely (e->key == tcache))
{
tcache_entry *tmp;
+ size_t cnt = 0;
LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
for (tmp = tcache->entries[tc_idx];
tmp;
- tmp = REVEAL_PTR (tmp->next))
+ tmp = REVEAL_PTR (tmp->next), ++cnt)
{
+ if (cnt >= mp_.tcache_count)
+ malloc_printerr ("free(): too many chunks detected in tcache");
if (__glibc_unlikely (!aligned_OK (tmp)))
malloc_printerr ("free(): unaligned chunk detected in tcache 2");
if (tmp == e)
--
2.25.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] malloc: tcache: detect infinite-loop in _int_free when freeing tcache [BZ#27052]
2020-12-11 14:06 [PATCH] malloc: tcache: detect infinite-loop in _int_free when freeing tcache [BZ#27052] W. Hashimoto
@ 2020-12-11 22:04 ` DJ Delorie
0 siblings, 0 replies; 2+ messages in thread
From: DJ Delorie @ 2020-12-11 22:04 UTC (permalink / raw)
To: W. Hashimoto; +Cc: libc-alpha, ssmallkirby
"W. Hashimoto via Libc-alpha" <libc-alpha@sourceware.org> writes:
> If linked-list of tcache contains a loop, it invokes infinite
> loop in _int_free when freeing tcache. The PoC which invokes
> such infinite loop is on the Bugzilla(#27052). This loop
> should terminate when the loop exceeds mp_.tcache_count and
> the program should abort. The affected glibc version is
> 2.29 or later.
LGTM. Thanks! Committed.
Reviewed-by: DJ Delorie <dj@redhat.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-12-11 22:04 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-11 14:06 [PATCH] malloc: tcache: detect infinite-loop in _int_free when freeing tcache [BZ#27052] W. Hashimoto
2020-12-11 22:04 ` DJ Delorie
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).