about summary refs log tree commit diff
path: root/malloc
Commit message (Collapse)AuthorAgeFilesLines
* malloc: Enable huge page support on main arenaAdhemerval Zanella2021-12-153-6/+14
| | | | | | | | | | | | This patch adds support huge page support on main arena allocation, enable with tunable glibc.malloc.hugetlb=2. The patch essentially disable the __glibc_morecore() sbrk() call (similar when memory tag does when sbrk() call does not support it) and fallback to default page size if the memory allocation fails. Checked on x86_64-linux-gnu. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Move MORECORE fallback mmap to sysmalloc_mmap_fallbackAdhemerval Zanella2021-12-151-32/+53
| | | | | | So it can be used on hugepage code as well. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Add Huge Page support to arenasAdhemerval Zanella2021-12-153-44/+99
| | | | | | | | | | | | | | | | | | | | | | | It is enabled as default for glibc.malloc.hugetlb set to 2 or higher. It also uses a non configurable minimum value and maximum value, currently set respectively to 1 and 4 selected huge page size. The arena allocation with huge pages does not use MAP_NORESERVE. As indicate by kernel internal documentation [1], the flag might trigger a SIGBUS on soft page faults if at memory access there is no left pages in the pool. On systems without a reserved huge pages pool, is just stress the mmap(MAP_HUGETLB) allocation failure. To improve test coverage it is required to create a pool with some allocated pages. Checked on x86_64-linux-gnu with no reserved pages, 10 reserved pages (which trigger mmap(MAP_HUGETBL) failures) and with 256 reserved pages (which does not trigger mmap(MAP_HUGETLB) failures). [1] https://www.kernel.org/doc/html/v4.18/vm/hugetlbfs_reserv.html#resv-map-modifications Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Add Huge Page support for mmapAdhemerval Zanella2021-12-153-9/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With the morecore hook removed, there is not easy way to provide huge pages support on with glibc allocator without resorting to transparent huge pages. And some users and programs do prefer to use the huge pages directly instead of THP for multiple reasons: no splitting, re-merging by the VM, no TLB shootdowns for running processes, fast allocation from the reserve pool, no competition with the rest of the processes unlike THP, no swapping all, etc. This patch extends the 'glibc.malloc.hugetlb' tunable: the value '2' means to use huge pages directly with the system default size, while a positive value means and specific page size that is matched against the supported ones by the system. Currently only memory allocated on sysmalloc() is handled, the arenas still uses the default system page size. To test is a new rule is added tests-malloc-hugetlb2, which run the addes tests with the required GLIBC_TUNABLE setting. On systems without a reserved huge pages pool, is just stress the mmap(MAP_HUGETLB) allocation failure. To improve test coverage it is required to create a pool with some allocated pages. Checked on x86_64-linux-gnu. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Move mmap logic to its own functionAdhemerval Zanella2021-12-151-76/+88
| | | | | | So it can be used with different pagesize and flags. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Add THP/madvise support for sbrkAdhemerval Zanella2021-12-151-5/+29
| | | | | | | | | | To increase effectiveness with Transparent Huge Page with madvise, the large page size is use instead page size for sbrk increment for the main arena. Checked on x86_64-linux-gnu. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Add madvise support for Transparent Huge PagesAdhemerval Zanella2021-12-154-0/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | Linux Transparent Huge Pages (THP) current supports three different states: 'never', 'madvise', and 'always'. The 'never' is self-explanatory and 'always' will enable THP for all anonymous pages. However, 'madvise' is still the default for some system and for such case THP will be only used if the memory range is explicity advertise by the program through a madvise(MADV_HUGEPAGE) call. To enable it a new tunable is provided, 'glibc.malloc.hugetlb', where setting to a value diffent than 0 enables the madvise call. This patch issues the madvise(MADV_HUGEPAGE) call after a successful mmap() call at sysmalloc() with sizes larger than the default huge page size. The madvise() call is disable is system does not support THP or if it has the mode set to "never" and on Linux only support one page size for THP, even if the architecture supports multiple sizes. To test is a new rule is added tests-malloc-hugetlb1, which run the addes tests with the required GLIBC_TUNABLE setting. Checked on x86_64-linux-gnu. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Fix malloc debug for 2.35 onwardsStafford Horne2021-11-171-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The change 1e5a5866cb ("Remove malloc hooks [BZ #23328]") has broken ports that are using GLIBC_2_35, like the new OpenRISC port I am working on. The libc_malloc_debug.so library used to bring in the debug infrastructure is currently essentially empty for GLIBC_2_35 ports like mine causing mtrace tests to fail: cat sysdeps/unix/sysv/linux/or1k/shlib-versions DEFAULT GLIBC_2.35 ld=ld-linux-or1k.so.1 FAIL: posix/bug-glob2-mem FAIL: posix/bug-regex14-mem FAIL: posix/bug-regex2-mem FAIL: posix/bug-regex21-mem FAIL: posix/bug-regex31-mem FAIL: posix/bug-regex36-mem FAIL: malloc/tst-mtrace. The issue seems to be with the ifdefs in malloc/malloc-debug.c. The ifdefs are currently essentially exluding all symbols for ports > 2.35. Removing the top level SHLIB_COMPAT ifdef allows things to just work. Fixes: 1e5a5866cb ("Remove malloc hooks [BZ #23328]") Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* elf: Introduce GLRO (dl_libc_freeres), called from __libc_freeresFlorian Weimer2021-11-171-0/+5
| | | | | | | This will be used to deallocate memory allocated using the non-minimal malloc. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Disable -Waggressive-loop-optimizations warnings in tst-dynarray.cJoseph Myers2021-10-291-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | My build-many-glibcs.py bot shows -Waggressive-loop-optimizations errors building the glibc testsuite for 32-bit architectures with GCC mainline, which seem to have appeared between GCC commits 4abc0c196b10251dc80d0743ba9e8ab3e56c61ed and d8edfadfc7a9795b65177a50ce44fd348858e844: In function 'dynarray_long_noscratch_resize', inlined from 'test_long_overflow' at tst-dynarray.c:489:5, inlined from 'do_test' at tst-dynarray.c:571:3: ../malloc/dynarray-skeleton.c:391:36: error: iteration 1073741823 invokes undefined behavior [-Werror=aggressive-loop-optimizations] 391 | DYNARRAY_ELEMENT_INIT (&list->u.dynarray_header.array[i]); tst-dynarray.c:39:37: note: in definition of macro 'DYNARRAY_ELEMENT_INIT' 39 | #define DYNARRAY_ELEMENT_INIT(e) (*(e) = 23) | ^ In file included from tst-dynarray.c:42: ../malloc/dynarray-skeleton.c:389:37: note: within this loop 389 | for (size_t i = old_size; i < size; ++i) | ~~^~~~~~ In function 'dynarray_long_resize', inlined from 'test_long_overflow' at tst-dynarray.c:479:5, inlined from 'do_test' at tst-dynarray.c:571:3: ../malloc/dynarray-skeleton.c:391:36: error: iteration 1073741823 invokes undefined behavior [-Werror=aggressive-loop-optimizations] 391 | DYNARRAY_ELEMENT_INIT (&list->u.dynarray_header.array[i]); tst-dynarray.c:27:37: note: in definition of macro 'DYNARRAY_ELEMENT_INIT' 27 | #define DYNARRAY_ELEMENT_INIT(e) (*(e) = 17) | ^ In file included from tst-dynarray.c:28: ../malloc/dynarray-skeleton.c:389:37: note: within this loop 389 | for (size_t i = old_size; i < size; ++i) | ~~^~~~~~ I don't know what GCC change made these errors appear, or why they only appear for 32-bit architectures. However, the warnings appear to be both true (that iteration would indeed involve undefined behavior if executed) and useless in this particular case (that iteration is never executed, because the allocation size overflows and so the allocation fails - but the check for allocation size overflow is in a separate source file and so can't be seen by the compiler when compiling this test). So use the DIAG_* macros to disable -Waggressive-loop-optimizations around the calls in question to dynarray_long_resize and dynarray_long_noscratch_resize in this test. Tested with build-many-glibcs.py (GCC mainline) for arm-linux-gnueabi, where it restores a clean testsuite build.
* Handle NULL input to malloc_usable_size [BZ #28506]Siddhesh Poyarekar2021-10-293-35/+25
| | | | | | | | | | Hoist the NULL check for malloc_usable_size into its entry points in malloc-debug and malloc and assume non-NULL in all callees. This fixes BZ #28506 Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Florian Weimer <fweimer@redhat.com> Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
* Add alloc_align attribute to memalign et alJonathan Wakely2021-10-211-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GCC 4.9.0 added the alloc_align attribute to say that a function argument specifies the alignment of the returned pointer. Clang supports the attribute too. Using the attribute can allow a compiler to generate better code if it knows the returned pointer has a minimum alignment. See https://gcc.gnu.org/PR60092 for more details. GCC implicitly knows the semantics of aligned_alloc and posix_memalign, but not the obsolete memalign. As a result, GCC generates worse code when memalign is used, compared to aligned_alloc. Clang knows about aligned_alloc and memalign, but not posix_memalign. This change adds a new __attribute_alloc_align__ macro to <sys/cdefs.h> and then uses it on memalign (where it helps GCC) and aligned_alloc (where GCC and Clang already know the semantics, but it doesn't hurt) and xposix_memalign. It can't be used on posix_memalign because that doesn't return a pointer (the allocated pointer is returned via a void** parameter instead). Unlike the alloc_size attribute, alloc_align only allows a single argument. That means the new __attribute_alloc_align__ macro doesn't really need to be used with double parentheses to protect a comma between its arguments. For consistency with __attribute_alloc_size__ this patch defines it the same way, so that double parentheses are required. Signed-off-by: Jonathan Wakely <jwakely@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* misc: Add __get_nprocs_schedAdhemerval Zanella2021-09-271-1/+1
| | | | | | | | | | | This is an internal function meant to return the number of avaliable processor where the process can scheduled, different than the __get_nprocs which returns a the system available online CPU. The Linux implementation currently only calls __get_nprocs(), which in tuns calls sched_getaffinity. Reviewed-by: Florian Weimer <fweimer@redhat.com>
* Remove "Contributed by" linesSiddhesh Poyarekar2021-09-0317-20/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | We stopped adding "Contributed by" or similar lines in sources in 2012 in favour of git logs and keeping the Contributors section of the glibc manual up to date. Removing these lines makes the license header a bit more consistent across files and also removes the possibility of error in attribution when license blocks or files are copied across since the contributed-by lines don't actually reflect reality in those cases. Move all "Contributed by" and similar lines (Written by, Test by, etc.) into a new file CONTRIBUTED-BY to retain record of these contributions. These contributors are also mentioned in manual/contrib.texi, so we just maintain this additional record as a courtesy to the earlier developers. The following scripts were used to filter a list of files to edit in place and to clean up the CONTRIBUTED-BY file respectively. These were not added to the glibc sources because they're not expected to be of any use in future given that this is a one time task: https://gist.github.com/siddhesh/b5ecac94eabfd72ed2916d6d8157e7dc https://gist.github.com/siddhesh/15ea1f5e435ace9774f485030695ee02 Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* mtrace: Fix output with PIE and ASLR [BZ #22716]Siddhesh Poyarekar2021-08-232-11/+10
| | | | | | | | | | | | | | Record only the relative address of the caller in mtrace file. Use LD_TRACE_PRELINKING to get the executable as well as binary vs executable load offsets so that we may compute a base to add to the relative address in the mtrace file. This allows us to get a valid address to pass to addr2line in all cases. Fixes BZ #22716. Co-authored-by: John Ogness <john.ogness@linutronix.de> Reviewed-by: Andreas Schwab <schwab@linux-m68k.org> Reviewed-by: DJ Delorie <dj@redhat.com>
* mtrace: Use a static buffer for printing [BZ #25947]Siddhesh Poyarekar2021-08-121-11/+3
| | | | | | | Use a static buffer for mtrace printing now that it no longer adds to default libc footprint. Reviewed-by: DJ Delorie <dj@redhat.com>
* tst-mxfast: Don't run with mcheckSiddhesh Poyarekar2021-08-051-1/+2
| | | | | The test may not show predictable behaviour with -lmcheck since the padding won't always guarantee fastbin usage.
* Exclude static tests for mcheck and malloc-checkSiddhesh Poyarekar2021-07-261-10/+3
| | | | | | | | | mcheck and malloc-check no longer work with static binaries, so drop those tests. Reported-by: Samuel Thibault <samuel.thibault@gnu.org> Tested-by: Samuel Thibault <samuel.thibault@gnu.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
* Fix build and tests with --disable-tunablesSiddhesh Poyarekar2021-07-233-30/+28
| | | | | | | | | | | | | Remove unused code and declare __libc_mallopt when !IS_IN (libc) to allow the debug hook to build with --disable-tunables. Also, run tst-ifunc-isa-2* tests only when tunables are enabled since the result depends on it. Tested on x86_64. Reported-by: Matheus Castanho <msc@linux.ibm.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* mcheck Fix malloc_usable_size [BZ #22057]Siddhesh Poyarekar2021-07-223-3/+9
| | | | | | | | Interpose malloc_usable_size to return the correct mcheck value for malloc_usable_size. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Remove malloc hooks [BZ #23328]Siddhesh Poyarekar2021-07-224-41/+41
| | | | | | | | | | | | | | Make malloc hooks symbols compat-only so that new applications cannot link against them and remove the declarations from the API. Also remove the unused malloc-hooks.h. Finally, mark all symbols in libc_malloc_debug.so as compat so that the library cannot be linked against. Add a note about the deprecation in NEWS. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Move malloc_{g,s}et_state to libc_malloc_debugSiddhesh Poyarekar2021-07-225-167/+193
| | | | | | | | | | | | | | | | | | | | | | | These deprecated functions are only safe to call from __malloc_initialize_hook and as a result, are not useful in the general case. Move the implementations to libc_malloc_debug so that existing binaries that need it will now have to preload the debug DSO to work correctly. This also allows simplification of the core malloc implementation by dropping all the undumping support code that was added to make malloc_set_state work. One known breakage is that of ancient emacs binaries that depend on this. They will now crash when running with this libc. With LD_BIND_NOW=1, it will terminate immediately because of not being able to find malloc_set_state but with lazy binding it will crash in unpredictable ways. It will need a preloaded libc_malloc_debug.so so that its initialization hook is executed to allow its malloc implementation to work properly. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* glibc.malloc.check: Wean away from malloc hooksSiddhesh Poyarekar2021-07-227-80/+213
| | | | | | | | | | | | | | | | | | The malloc-check debugging feature is tightly integrated into glibc malloc, so thanks to an idea from Florian Weimer, much of the malloc implementation has been moved into libc_malloc_debug.so to support malloc-check. Due to this, glibc malloc and malloc-check can no longer work together; they use altogether different (but identical) structures for heap management. This should not make a difference though since the malloc check hook is not disabled anywhere. malloc_set_state does, but it does so early enough that it shouldn't cause any problems. The malloc check tunable is now in the debug DSO and has no effect when the DSO is not preloaded. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* mtrace: Wean away from malloc hooksSiddhesh Poyarekar2021-07-224-302/+253
| | | | | | | | | | | | | Wean mtrace away from the malloc hooks and move them into the debug DSO. Split the API away from the implementation so that we can add the API to libc.so as well as libc_malloc_debug.so, with the libc implementations being empty. Update localplt data since memalign no longer has any callers after this change. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Simplify __malloc_initializedSiddhesh Poyarekar2021-07-222-18/+18
| | | | | | | | | Now that mcheck no longer needs to check __malloc_initialized (and no other third party hook can since the symbol is not exported), make the variable boolean and static so that it is used strictly within malloc. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* mcheck: Wean away from malloc hooks [BZ #23489]Siddhesh Poyarekar2021-07-226-458/+592
| | | | | | | | | | | | | | | | | | | | | | | | Split the mcheck implementation into the debugging hooks and API so that the API can be replicated in libc and libc_malloc_debug.so. The libc APIs always result in failure. The mcheck implementation has also been moved entirely into libc_malloc_debug.so and with it, all of the hook initialization code can now be moved into the debug library. Now the initialization can be done independently of libc internals. With this patch, libc_malloc_debug.so can no longer be used with older libcs, which is not its goal anyway. tst-vfork3 breaks due to this since it spawns shell scripts, which in turn execute using the system glibc. Move the test to tests-container so that only the built glibc is used. This move also fixes bugs in the mcheck version of memalign and realloc, thus allowing removal of the tests from tests-mcheck exclusion list. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Move malloc hooks into a compat DSOSiddhesh Poyarekar2021-07-2213-111/+453
| | | | | | | | | | | | | | | | | | | | | | | | Remove all malloc hook uses from core malloc functions and move it into a new library libc_malloc_debug.so. With this, the hooks now no longer have any effect on the core library. libc_malloc_debug.so is a malloc interposer that needs to be preloaded to get hooks functionality back so that the debugging features that depend on the hooks, i.e. malloc-check, mcheck and mtrace work again. Without the preloaded DSO these debugging features will be nops. These features will be ported away from hooks in subsequent patches. Similarly, legacy applications that need hooks functionality need to preload libc_malloc_debug.so. The symbols exported by libc_malloc_debug.so are maintained at exactly the same version as libc.so. Finally, static binaries will no longer be able to use malloc debugging features since they cannot preload the debugging DSO. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Remove __morecore and __default_morecoreSiddhesh Poyarekar2021-07-226-46/+19
| | | | | | | | | | Make the __morecore and __default_morecore symbols compat-only and remove their declarations from the API. Also, include morecore.c directly into malloc.c; this should ideally get merged into malloc in a future cleanup. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Remove __after_morecore_hookSiddhesh Poyarekar2021-07-223-24/+6
| | | | | | | | | | Remove __after_morecore_hook from the API and finalize the symbol so that it can no longer be used in new applications. Old applications using __after_morecore_hook will find that their hook is no longer called. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* Make mcheck tests conditional on GLIBC_2.23 or earlierSiddhesh Poyarekar2021-07-221-0/+3
| | | | | | | | | | Targets with base versions of 2.24 or later won't have __malloc_initialize_hook because of which the tests will essentially be the same as the regular malloc tests. Avoid running them instead and save time. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
* malloc: Fix tst-mallocfork3-malloc-check linkSamuel Thibault2021-07-221-0/+1
| | | | It uses pthread.
* tst-safe-linking: make false positives even more improbableSiddhesh Poyarekar2021-07-191-6/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a 1 in 16 chance of a corruption escaping safe-linking and to guard against spurious failures, tst-safe-linking runs each subtest 10 times to ensure that the chance is reduced to 1 in 2^40. However, in the 1 in 16 chance that a corruption does escape safe linking, it could well be caught by other sanity checks we do in malloc, which then results in spurious test failures like below: test test_fastbin_consolidate failed with a different error expected: malloc_consolidate(): unaligned fastbin chunk detected actual: malloc_consolidate(): invalid chunk size This failure is seen more frequently on i686; I was able to reproduce it in about 5 min of running it in a loop. Guard against such failures by recording them and retrying the test. Also, do not fail the test if we happened to get defeated by the 1 in 2^40 odds if in at least one of the instances it was detected by other checks. Finally, bolster the odds to 2^64 by running 16 times instead of 10. The test still has a chance of failure so it is still flaky in theory. However in practice if we see a failure here then it's more likely that there's a bug than it being an issue with the test. Add more printfs and also dump them to stdout so that in the event the test actually fails, we will have some data to try and understand why it may have failed. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* mcheck: Align struct hdr to MALLOC_ALIGNMENT bytes [BZ #28068]H.J. Lu2021-07-122-2/+5
| | | | | | | | | | | | 1. Align struct hdr to MALLOC_ALIGNMENT bytes so that malloc hooks in libmcheck align memory to MALLOC_ALIGNMENT bytes. 2. Remove tst-mallocalign1 from tests-exclude-mcheck for i386 and x32. 3. Add tst-pvalloc-fortify and tst-reallocarray to tests-exclude-mcheck since they use malloc_usable_size (see BZ #22057). This fixed BZ #28068. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* Force building with -fno-commonFlorian Weimer2021-07-092-2/+2
| | | | | | | | | | As a result, is not necessary to specify __attribute__ ((nocommon)) on individual definitions. GCC 10 defaults to -fno-common on all architectures except ARC, but this change is compatible with older GCC versions and ARC, too. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Add a generic malloc test for MALLOC_ALIGNMENTH.J. Lu2021-07-093-40/+73
| | | | | | | | | 1. Add sysdeps/generic/malloc-size.h to define size related macros for malloc. 2. Move x86_64/tst-mallocalign1.c to malloc and replace ALIGN_MASK with MALLOC_ALIGN_MASK. 3. Add tst-mallocalign1 to tests-exclude-mcheck for i386 and x32 since mcheck doesn't honor MALLOC_ALIGNMENT.
* _int_realloc is staticSiddhesh Poyarekar2021-07-081-2/+2
| | | | | | _int_realloc is correctly declared at the top to be static, but incorrectly defined without the static keyword. Fix that. The generated binaries have identical code.
* Move mcheck symbol from stdlib to mallocSiddhesh Poyarekar2021-07-081-1/+1
| | | | | It is defined in malloc, so it belongs there. Verified on x86_64 that the built libraries are identical despite this change.
* Harden tcache double-free checkSiddhesh Poyarekar2021-07-082-4/+41
| | | | | | | | | | | | | | | | | | | | The tcache allocator layer uses the tcache pointer as a key to identify a block that may be freed twice. Since this is in the application data area, an attacker exploiting a use-after-free could potentially get access to the entire tcache structure through this key. A detailed write-up was provided by Awarau here: https://awaraucom.wordpress.com/2020/07/19/house-of-io-remastered/ Replace this static pointer use for key checking with one that is generated at malloc initialization. The first attempt is through getrandom with a fallback to random_bits(), which is a simple pseudo-random number generator based on the clock. The fallback ought to be sufficient since the goal of the randomness is only to make the key arbitrary enough that it is very unlikely to collide with user data. Co-authored-by: Eyal Itkin <eyalit@checkpoint.com>
* tests-exclude-mcheck: Fix typoSiddhesh Poyarekar2021-07-071-1/+1
| | | | | | | It's tst-realloc, not tst-posix-realloc. Verified this time to ensure that the total number of tests reduced by 1. Reported-by: Stefan Liebler <stli@linux.ibm.com>
* Exclude tst-realloc from tests-mcheckSiddhesh Poyarekar2021-07-061-1/+2
| | | | | | | | | | | | The realloc (NULL, 0) test in tst-realloc fails with gcc 7.x but passes with newer gcc. This is because a newer gcc transforms the realloc call to malloc (0), thus masking the bug in mcheck. Disable the test with mcheck for now. The malloc removal patchset will fix this and then remove this test from the exclusion list. Reported-by: Stefan Liebler <stli@linux.ibm.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* hooks.c: Remove incorrect commentSiddhesh Poyarekar2021-07-041-4/+0
| | | | | The comment about different values of glibc.malloc.check is no longer valid.
* mtrace: Add attribute nocommon to mallwatchTulio Magno Quites Machado Filho2021-07-021-1/+1
| | | | | | | | | | | Avoid compilation errors GCC versions that do not default to -fno-common, e.g. GCC <= 9. Fixes commit 00d28960c5388a582a0485e07629b553c32dde49 ("mtrace: Deprecate mallwatch and tr_break"). Suggested-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Suggested-by: Florian Weimer <fweimer@redhat.com>
* Move glibc.malloc.check implementation into its own fileSiddhesh Poyarekar2021-07-032-370/+391
| | | | | | | Separate the malloc check implementation from the malloc hooks. They still use the hooks but are now maintained in a separate file. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* mtrace: Deprecate mallwatch and tr_breakSiddhesh Poyarekar2021-07-031-37/+20
| | | | | | | | | | | | | The variable and function pair appear to provide a way for users to set conditional breakpoints in mtrace when a specific address is returned by the allocator. This can be achieved by using conditional breakpoints in gdb so it is redundant. There is no documentation of this interface in the manual either, so it appears to have been a hack that got added to debug malloc. Deprecate these symbols and do not call tr_break anymore. Reviewed-by: DJ Delorie <dj@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Drop source dependencies on hooks.c and arena.cSiddhesh Poyarekar2021-07-031-4/+0
| | | | | | | | Dependencies on hooks.c and arena.c get auto-computed when generating malloc.o{,s}.d so there is no need to add them manually. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Andreas Schwab <schwab@linux-m68k.org>
* malloc: Initiate tcache shutdown even without allocations [BZ #28028]JeffyChen2021-07-021-1/+2
| | | | | | | | | | After commit 1e26d35193efbb29239c710a4c46a64708643320 ("malloc: Fix tcache leak after thread destruction [BZ #22111]"), tcache_shutting_down is still not early enough. When we detach a thread with no tcache allocated, tcache_shutting_down would still be false. Reviewed-by: DJ Delorie <dj@redhat.com>
* Add mcheck tests to mallocSiddhesh Poyarekar2021-07-021-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | Like malloc-check, add generic rules to run all tests in malloc by linking with libmcheck.a so as to provide coverage for mcheck(). Currently the following 12 tests fail: FAIL: malloc/tst-malloc-backtrace-mcheck FAIL: malloc/tst-malloc-fork-deadlock-mcheck FAIL: malloc/tst-malloc-stats-cancellation-mcheck FAIL: malloc/tst-malloc-tcache-leak-mcheck FAIL: malloc/tst-malloc-thread-exit-mcheck FAIL: malloc/tst-malloc-thread-fail-mcheck FAIL: malloc/tst-malloc-usable-static-mcheck FAIL: malloc/tst-malloc-usable-static-tunables-mcheck FAIL: malloc/tst-malloc-usable-tunables-mcheck FAIL: malloc/tst-malloc_info-mcheck FAIL: malloc/tst-memalign-mcheck FAIL: malloc/tst-posix_memalign-mcheck and they have been added to tests-exclude-mcheck for now to keep status quo. At least the last two can be attributed to bugs in mcheck() but I haven't fixed them here since they should be fixed by removing malloc hooks. Others need to be triaged to check if they're due to mcheck bugs or due to actual bugs. Reviewed-by: DJ Delorie <dj@redhat.com>
* posix: Add _Fork [BZ #4737]Adhemerval Zanella2021-06-282-0/+216
| | | | | | | | | | | | | | | | | | | | | | | | | Austin Group issue 62 [1] dropped the async-signal-safe requirement for fork and provided a async-signal-safe _Fork replacement that does not run the atfork handlers. It will be included in the next POSIX standard. It allow to close a long standing issue to make fork AS-safe (BZ#4737). As indicated on the bug, besides the internal lock for the atfork handlers itself; there is no guarantee that the handlers itself will not introduce more AS-safe issues. The idea is synchronize fork with the required internal locks to allow children in multithread processes to use mostly of standard function (even though POSIX states only AS-safe function should be used). On signal handles, _Fork should be used intead and only AS-safe functions should be used. For testing, the new tst-_Fork only check basic usage. I also added a new tst-mallocfork3 which uses the same strategy to check for deadlock of tst-mallocfork2 but using threads instead of subprocesses (and it does deadlock if it replaces _Fork with fork). [1] https://austingroupbugs.net/view.php?id=62
* More mcheck -> malloc-check refactoringSiddhesh Poyarekar2021-06-231-13/+17
| | | | | Refactored malloc-check rules for tests that are automatically generated and executed with MALLOC_CHECK_=3.
* malloc: Drop __malloc_initialized from VersionsSiddhesh Poyarekar2021-06-221-1/+1
| | | | | __malloc_initialized is mentioned in Versions when it is actually an internal symbol. The resultant binaries are identical.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-14 18:10:27 +0000