public inbox for newlib@sourceware.org
 help / color / mirror / Atom feed
From: "Torbjörn SVENSSON" <torbjorn.svensson@foss.st.com>
To: <newlib@sourceware.org>
Cc: "Torbjörn SVENSSON" <torbjorn.svensson@foss.st.com>
Subject: [PATCH 1/2] Used chunk needs to be removed from free_list
Date: Tue, 30 Aug 2022 15:56:25 +0200	[thread overview]
Message-ID: <20220830135625.2247198-1-torbjorn.svensson@foss.st.com> (raw)

When using nano malloc and the remaning heap space is not big enough to
fullfill the allocation, malloc will attempt to merge the last chunk in
the free list with a new allocation in order to create a bigger chunk.
This is successful, but the chunk still remains in the free_list, so
any later call to malloc can give out the same region without it first
being freed.

Possible sequence to verify:

void *p1 = malloc(3000);
void *p2 = malloc(4000);
void *p3 = malloc(5000);
void *p4 = malloc(6000);
void *p5 = malloc(7000);
free(p2);
free(p4);
void *p6 = malloc(35000);
free(p6);
void *p7 = malloc(42000);
void *p8 = malloc(32000);

Without the change, p7 and p8 points to the same address.
Requirement, after malloc(35000), there is less than 42000 bytes
available on the heap.

Contributed by STMicroelectronics

Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson@foss.st.com>
---
 newlib/libc/stdlib/nano-mallocr.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c
index 99ad60dd0..43eb20e07 100644
--- a/newlib/libc/stdlib/nano-mallocr.c
+++ b/newlib/libc/stdlib/nano-mallocr.c
@@ -336,6 +336,15 @@ void * nano_malloc(RARG malloc_size_t s)
                if (sbrk_aligned(RCALL alloc_size) != (void *)-1)
                {
                    p->size += alloc_size;
+
+                   /* Remove chunk from free_list */
+                   r = free_list;
+                   while (r && p != r->next)
+                   {
+                     r = r->next;
+                   }
+                   r->next = NULL;
+
                    r = p;
                }
                else
-- 
2.25.1


WARNING: multiple messages have this Message-ID
From: "Torbjörn SVENSSON" <torbjorn.svensson@foss.st.com>
To: <newlib@sourceware.org>
Subject: [PATCH 1/2] Used chunk needs to be removed from free_list
Date: Tue, 30 Aug 2022 15:56:25 +0200	[thread overview]
Message-ID: <20220830135625.2247198-1-torbjorn.svensson@foss.st.com> (raw)
Message-ID: <20220830135625.4kzESCVUBopSppIzQGGRdSumBGZ8pnNBaRB87yZtrwU@z> (raw)

When using nano malloc and the remaning heap space is not big enough to
fullfill the allocation, malloc will attempt to merge the last chunk in
the free list with a new allocation in order to create a bigger chunk.
This is successful, but the chunk still remains in the free_list, so
any later call to malloc can give out the same region without it first
being freed.

Possible sequence to verify:

void *p1 = malloc(3000);
void *p2 = malloc(4000);
void *p3 = malloc(5000);
void *p4 = malloc(6000);
void *p5 = malloc(7000);
free(p2);
free(p4);
void *p6 = malloc(35000);
free(p6);
void *p7 = malloc(42000);
void *p8 = malloc(32000);

Without the change, p7 and p8 points to the same address.
Requirement, after malloc(35000), there is less than 42000 bytes
available on the heap.

Contributed by STMicroelectronics

Signed-off-by: Torbjörn SVENSSON <torbjorn.svensson@foss.st.com>
---
 newlib/libc/stdlib/nano-mallocr.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/newlib/libc/stdlib/nano-mallocr.c b/newlib/libc/stdlib/nano-mallocr.c
index 99ad60dd0..43eb20e07 100644
--- a/newlib/libc/stdlib/nano-mallocr.c
+++ b/newlib/libc/stdlib/nano-mallocr.c
@@ -336,6 +336,15 @@ void * nano_malloc(RARG malloc_size_t s)
                if (sbrk_aligned(RCALL alloc_size) != (void *)-1)
                {
                    p->size += alloc_size;
+
+                   /* Remove chunk from free_list */
+                   r = free_list;
+                   while (r && p != r->next)
+                   {
+                     r = r->next;
+                   }
+                   r->next = NULL;
+
                    r = p;
                }
                else
-- 
2.25.1


             reply	other threads:[~2022-08-30 13:57 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-30 13:56 Torbjörn SVENSSON [this message]
2022-08-30 13:56 ` Torbjörn SVENSSON
2022-08-30 13:56 ` [PATCH 2/2] Don't allocate another header when merging chunks Torbjörn SVENSSON
2022-08-30 13:56   ` Torbjörn SVENSSON
2022-09-01 18:44   ` Jeff Johnston
2022-09-01 19:04     ` Torbjorn SVENSSON
2022-09-01 19:36       ` Jeff Johnston
2022-09-01 19:39   ` Jeff Johnston
2022-09-01 18:41 ` [PATCH 1/2] Used chunk needs to be removed from free_list Jeff Johnston

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220830135625.2247198-1-torbjorn.svensson@foss.st.com \
    --to=torbjorn.svensson@foss.st.com \
    --cc=newlib@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).