From: Siddhesh Poyarekar <siddhesh@sourceware.org>
To: libc-stable@sourceware.org
Cc: Wilco Dijkstra <wdijkstr@arm.com>
Subject: [PATCH 06/10] Fix deadlock in _int_free consistency check
Date: Sun, 01 Jan 2017 00:00:00 -0000 [thread overview]
Message-ID: <1511878186-31499-7-git-send-email-siddhesh@sourceware.org> (raw)
In-Reply-To: <1511878186-31499-1-git-send-email-siddhesh@sourceware.org>
From: Wilco Dijkstra <wdijkstr@arm.com>
This patch fixes a deadlock in the fastbin consistency check.
If we fail the fast check due to concurrent modifications to
the next chunk or system_mem, we should not lock if we already
have the arena lock. Simplify the check to make it obviously
correct.
* malloc/malloc.c (_int_free): Fix deadlock bug in consistency check.
(cherry-pick d74e6f6c0de55fc588b1ac09c88eb0fb8b8600af)
---
ChangeLog | 4 ++++
malloc/malloc.c | 21 ++++++++++++---------
2 files changed, 16 insertions(+), 9 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index d536c9a..49b720f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2017-10-19 Wilco Dijkstra <wdijkstr@arm.com>
+
+ * malloc/malloc.c (_int_free): Fix deadlock bug in consistency check.
+
2017-08-31 Florian Weimer <fweimer@redhat.com>
* malloc/malloc.c (_int_free): Remove locked variable and related
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 3608b34..44996e0 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4148,17 +4148,20 @@ _int_free (mstate av, mchunkptr p, int have_lock)
|| __builtin_expect (chunksize (chunk_at_offset (p, size))
>= av->system_mem, 0))
{
+ bool fail = true;
/* We might not have a lock at this point and concurrent modifications
- of system_mem might have let to a false positive. Redo the test
- after getting the lock. */
- if (!have_lock
- || ({ __libc_lock_lock (av->mutex);
- chunksize_nomask (chunk_at_offset (p, size)) <= 2 * SIZE_SZ
- || chunksize (chunk_at_offset (p, size)) >= av->system_mem;
- }))
+ of system_mem might result in a false positive. Redo the test after
+ getting the lock. */
+ if (!have_lock)
+ {
+ __libc_lock_lock (av->mutex);
+ fail = (chunksize_nomask (chunk_at_offset (p, size)) <= 2 * SIZE_SZ
+ || chunksize (chunk_at_offset (p, size)) >= av->system_mem);
+ __libc_lock_unlock (av->mutex);
+ }
+
+ if (fail)
malloc_printerr ("free(): invalid next size (fast)");
- if (! have_lock)
- __libc_lock_unlock (av->mutex);
}
free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
--
2.7.5
next prev parent reply other threads:[~2017-11-28 14:10 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-01 0:00 [PATCH 00/10][2.26] Malloc fixes and improvements Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 04/10] malloc: Change top_check return type to void Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 09/10] Add single-threaded path to malloc/realloc/calloc/memalloc Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 10/10] Add single-threaded path to _int_malloc Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 00/10][2.26] Malloc fixes and improvements Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 07/10] Add single-threaded path to _int_free Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 03/10] malloc: Remove corrupt arena flag Siddhesh Poyarekar
2017-01-01 0:00 ` Siddhesh Poyarekar [this message]
2017-01-01 0:00 ` [PATCH 05/10] malloc: Resolve compilation failure in NDEBUG mode Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 01/10] malloc: Abort on heap corruption, without a backtrace [BZ #21754] Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 08/10] Fix build issue with SINGLE_THREAD_P Siddhesh Poyarekar
2017-01-01 0:00 ` [PATCH 02/10] malloc: Remove check_action variable [BZ #21754] Siddhesh Poyarekar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1511878186-31499-7-git-send-email-siddhesh@sourceware.org \
--to=siddhesh@sourceware.org \
--cc=libc-stable@sourceware.org \
--cc=wdijkstr@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).