about summary refs log tree commit diff
path: root/malloc
Commit message (Collapse)AuthorAgeFilesLines
...
* _int_realloc is staticSiddhesh Poyarekar2021-07-081-2/+2
| | | | | | _int_realloc is correctly declared at the top to be static, but incorrectly defined without the static keyword. Fix that. The generated binaries have identical code.
* Move mcheck symbol from stdlib to mallocSiddhesh Poyarekar2021-07-081-1/+1
| | | | | It is defined in malloc, so it belongs there. Verified on x86_64 that the built libraries are identical despite this change.
* Harden tcache double-free checkSiddhesh Poyarekar2021-07-082-4/+41
| | | | | | | | | | | | | | | | | | | | The tcache allocator layer uses the tcache pointer as a key to identify a block that may be freed twice. Since this is in the application data area, an attacker exploiting a use-after-free could potentially get access to the entire tcache structure through this key. A detailed write-up was provided by Awarau here: https://awaraucom.wordpress.com/2020/07/19/house-of-io-remastered/ Replace this static pointer use for key checking with one that is generated at malloc initialization. The first attempt is through getrandom with a fallback to random_bits(), which is a simple pseudo-random number generator based on the clock. The fallback ought to be sufficient since the goal of the randomness is only to make the key arbitrary enough that it is very unlikely to collide with user data. Co-authored-by: Eyal Itkin <eyalit@checkpoint.com>
* tests-exclude-mcheck: Fix typoSiddhesh Poyarekar2021-07-071-1/+1
| | | | | | | It's tst-realloc, not tst-posix-realloc. Verified this time to ensure that the total number of tests reduced by 1. Reported-by: Stefan Liebler <stli@linux.ibm.com>
* Exclude tst-realloc from tests-mcheckSiddhesh Poyarekar2021-07-061-1/+2
| | | | | | | | | | | | The realloc (NULL, 0) test in tst-realloc fails with gcc 7.x but passes with newer gcc. This is because a newer gcc transforms the realloc call to malloc (0), thus masking the bug in mcheck. Disable the test with mcheck for now. The malloc removal patchset will fix this and then remove this test from the exclusion list. Reported-by: Stefan Liebler <stli@linux.ibm.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* hooks.c: Remove incorrect commentSiddhesh Poyarekar2021-07-041-4/+0
| | | | | The comment about different values of glibc.malloc.check is no longer valid.
* mtrace: Add attribute nocommon to mallwatchTulio Magno Quites Machado Filho2021-07-021-1/+1
| | | | | | | | | | | Avoid compilation errors GCC versions that do not default to -fno-common, e.g. GCC <= 9. Fixes commit 00d28960c5388a582a0485e07629b553c32dde49 ("mtrace: Deprecate mallwatch and tr_break"). Suggested-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> Suggested-by: Florian Weimer <fweimer@redhat.com>
* Move glibc.malloc.check implementation into its own fileSiddhesh Poyarekar2021-07-032-370/+391
| | | | | | | Separate the malloc check implementation from the malloc hooks. They still use the hooks but are now maintained in a separate file. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* mtrace: Deprecate mallwatch and tr_breakSiddhesh Poyarekar2021-07-031-37/+20
| | | | | | | | | | | | | The variable and function pair appear to provide a way for users to set conditional breakpoints in mtrace when a specific address is returned by the allocator. This can be achieved by using conditional breakpoints in gdb so it is redundant. There is no documentation of this interface in the manual either, so it appears to have been a hack that got added to debug malloc. Deprecate these symbols and do not call tr_break anymore. Reviewed-by: DJ Delorie <dj@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Drop source dependencies on hooks.c and arena.cSiddhesh Poyarekar2021-07-031-4/+0
| | | | | | | | Dependencies on hooks.c and arena.c get auto-computed when generating malloc.o{,s}.d so there is no need to add them manually. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Andreas Schwab <schwab@linux-m68k.org>
* malloc: Initiate tcache shutdown even without allocations [BZ #28028]JeffyChen2021-07-021-1/+2
| | | | | | | | | | After commit 1e26d35193efbb29239c710a4c46a64708643320 ("malloc: Fix tcache leak after thread destruction [BZ #22111]"), tcache_shutting_down is still not early enough. When we detach a thread with no tcache allocated, tcache_shutting_down would still be false. Reviewed-by: DJ Delorie <dj@redhat.com>
* Add mcheck tests to mallocSiddhesh Poyarekar2021-07-021-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | Like malloc-check, add generic rules to run all tests in malloc by linking with libmcheck.a so as to provide coverage for mcheck(). Currently the following 12 tests fail: FAIL: malloc/tst-malloc-backtrace-mcheck FAIL: malloc/tst-malloc-fork-deadlock-mcheck FAIL: malloc/tst-malloc-stats-cancellation-mcheck FAIL: malloc/tst-malloc-tcache-leak-mcheck FAIL: malloc/tst-malloc-thread-exit-mcheck FAIL: malloc/tst-malloc-thread-fail-mcheck FAIL: malloc/tst-malloc-usable-static-mcheck FAIL: malloc/tst-malloc-usable-static-tunables-mcheck FAIL: malloc/tst-malloc-usable-tunables-mcheck FAIL: malloc/tst-malloc_info-mcheck FAIL: malloc/tst-memalign-mcheck FAIL: malloc/tst-posix_memalign-mcheck and they have been added to tests-exclude-mcheck for now to keep status quo. At least the last two can be attributed to bugs in mcheck() but I haven't fixed them here since they should be fixed by removing malloc hooks. Others need to be triaged to check if they're due to mcheck bugs or due to actual bugs. Reviewed-by: DJ Delorie <dj@redhat.com>
* posix: Add _Fork [BZ #4737]Adhemerval Zanella2021-06-282-0/+216
| | | | | | | | | | | | | | | | | | | | | | | | | Austin Group issue 62 [1] dropped the async-signal-safe requirement for fork and provided a async-signal-safe _Fork replacement that does not run the atfork handlers. It will be included in the next POSIX standard. It allow to close a long standing issue to make fork AS-safe (BZ#4737). As indicated on the bug, besides the internal lock for the atfork handlers itself; there is no guarantee that the handlers itself will not introduce more AS-safe issues. The idea is synchronize fork with the required internal locks to allow children in multithread processes to use mostly of standard function (even though POSIX states only AS-safe function should be used). On signal handles, _Fork should be used intead and only AS-safe functions should be used. For testing, the new tst-_Fork only check basic usage. I also added a new tst-mallocfork3 which uses the same strategy to check for deadlock of tst-mallocfork2 but using threads instead of subprocesses (and it does deadlock if it replaces _Fork with fork). [1] https://austingroupbugs.net/view.php?id=62
* More mcheck -> malloc-check refactoringSiddhesh Poyarekar2021-06-231-13/+17
| | | | | Refactored malloc-check rules for tests that are automatically generated and executed with MALLOC_CHECK_=3.
* malloc: Drop __malloc_initialized from VersionsSiddhesh Poyarekar2021-06-221-1/+1
| | | | | __malloc_initialized is mentioned in Versions when it is actually an internal symbol. The resultant binaries are identical.
* tst-mcheck: Rename to tst-malloc-checkSiddhesh Poyarekar2021-06-222-3/+3
| | | | | | MALLOC_CHECK_ and mcheck() are two different malloc checking features. tst-mcheck does not check mcheck(), instead it checks MALLOC_CHECK_, so rename the file to avoid confusion.
* dlfcn: Cleanups after -ldl is no longer requiredFlorian Weimer2021-06-031-3/+0
| | | | | | | | | | | | This commit removes the ELF constructor and internal variables from dlfcn/dlfcn.c. The file now serves the same purpose as nptl/libpthread-compat.c, so it is renamed to dlfcn/libdl-compat.c. The use of libdl-shared-only-routines ensures that libdl.a is empty. This commit adjusts the test suite not to use $(libdl). The libdl.so symbolic link is no longer installed. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* fix typoXeonacid2021-06-021-1/+1
| | | | | "accomodate" should be "accommodate" Reviewed-by: Paul Zimmermann <Paul.Zimmermann@inria.fr>
* tst-mallinfo2.c: Use correct multiple for total variableYang Xu2021-05-251-2/+2
| | | | | | | | | Since test uses 160 multiple for malloc size, we should also use 160 multiple for total variable instead of 16, then comparison is meaningful. So fix it. Also change the ">" to ">=" so that the test is technically valid. Reviewed-by: DJ Delorie <dj@redhat.com>
* Missing ENOMEM in realloc_check wrapper (bug 27870)Andreas Schwab2021-05-172-2/+5
| | | | | | When MALLOC_CHECK_ is non-zero, the realloc hook missed to set errno to ENOMEM when called with too big size. Run the test tst-malloc-too-large also with MALLOC_CHECK_=3 to catch that.
* Enable support for GCC 11 -Wmismatched-dealloc.Martin Sebor2021-05-161-4/+7
| | | | | | | | | | | | | | | | | | | | | | | To help detect common kinds of memory (and other resource) management bugs, GCC 11 adds support for the detection of mismatched calls to allocation and deallocation functions. At each call site to a known deallocation function GCC checks the set of allocation functions the former can be paired with and, if the two don't match, issues a -Wmismatched-dealloc warning (something similar happens in C++ for mismatched calls to new and delete). GCC also uses the same mechanism to detect attempts to deallocate objects not allocated by any allocation function (or pointers past the first byte into allocated objects) by -Wfree-nonheap-object. This support is enabled for built-in functions like malloc and free. To extend it beyond those, GCC extends attribute malloc to designate a deallocation function to which pointers returned from the allocation function may be passed to deallocate the allocated objects. Another, optional argument designates the positional argument to which the pointer must be passed. This change is the first step in enabling this extended support for Glibc.
* Remove all usage of @BASH@ or ${BASH} in installed files, and hardcode ↵Romain GEISSLER2021-05-122-4/+3
| | | | | | | | | | | | | | | | | | | /bin/bash instead (FYI, this is a repost of https://sourceware.org/pipermail/libc-alpha/2019-July/105035.html now that FSF papers have been signed and confirmed on FSF side). This trivial patch attemps to fix BZ 24106. Basically the bash locally used when building glibc on the host shall not leak on the installed glibc, as the system where it is installed might be different and use another bash location. So I have looked for all occurences of @BASH@ or $(BASH) in installed files, and replaced it by /bin/bash. This was suggested by Florian Weimer in the bug report. Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
* nptl: Move stack cache management, __libpthread_freeres into libcFlorian Weimer2021-05-111-5/+10
| | | | | | | | | | | | | This replaces the FREE_P macro with the __nptl_stack_in_use inline function. stack_list_del is renamed to __nptl_stack_list_del, stack_list_add to __nptl_stack_list_add, __deallocate_stack to __nptl_deallocate_stack, free_stacks to __nptl_free_stacks. It is convenient to move __libpthread_freeres into libc at the same time. This removes the temporary __default_pthread_attr_freeres export and restores full freeres coverage for __default_pthread_attr. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* malloc: Make tunable callback functions staticH.J. Lu2021-05-071-2/+2
| | | | | Since malloc tunable callback functions are only used within the same file, we should make them static.
* dlfcn: dlerror needs to call free from the base namespace [BZ #24773]Florian Weimer2021-04-212-7/+5
| | | | | | | | | | | | Calling free directly may end up freeing a pointer allocated by the dynamic loader using malloc from libc.so in the base namespace using the allocator from libc.so in a secondary namespace, which results in crashes. This commit redirects the free call through GLRO and the dynamic linker, to reach the correct namespace. It also cleans up the dlerror handling along the way, so that pthread_setspecific is no longer needed (which avoids triggering bug 24774).
* Further fixes for REALLOC_ZERO_BYTES_FREES commentPaul Eggert2021-04-121-7/+8
| | | | * malloc/malloc.c (REALLOC_ZERO_BYTES_FREES): Improve comment further.
* Fix REALLOC_ZERO_BYTES_FREES comment to match C17Paul Eggert2021-04-111-4/+7
| | | | | * malloc/malloc.c (REALLOC_ZERO_BYTES_FREES): Update comment to match current C standard.
* malloc: Run tst-malloc-stats-cancellation via test-driver.cArjun Shankar2021-04-071-2/+4
| | | | | | This allows the test to time out in case it hangs. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* malloc: Ensure mtag code path in checked_request2size is coldSzabolcs Nagy2021-03-261-2/+7
| | | | | | | | | This is a workaround (hack) for a gcc optimization issue (PR 99551). Without this the generated code may evaluate the expression in the cold path which causes performance regression for small allocations in the memory tagging disabled (common) case. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Remove unnecessary tagging around _mid_memalignSzabolcs Nagy2021-03-261-8/+2
| | | | | | | | The internal _mid_memalign already returns newly tagged memory. (__libc_memalign and posix_memalign already relied on this, this patch fixes the other call sites.) Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Rename chunk2rawmemSzabolcs Nagy2021-03-262-43/+43
| | | | | | | | | | | The previous patch ensured that all chunk to mem computations use chunk2rawmem, so now we can rename it to chunk2mem, and in the few cases where the tag of mem is relevant chunk2mem_tag can be used. Replaced tag_at (chunk2rawmem (x)) with chunk2mem_tag (x). Renamed chunk2rawmem to chunk2mem. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Use chunk2rawmem throughoutSzabolcs Nagy2021-03-262-26/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The difference between chunk2mem and chunk2rawmem is that the latter does not get the memory tag for the returned pointer. It turns out chunk2rawmem almost always works: The input of chunk2mem is a chunk pointer that is untagged so it can access the chunk header. All memory that is not user allocated heap memory is untagged, which in the current implementation means that it has the 0 tag, but this patch does not rely on the tag value. The patch relies on that chunk operations are either done on untagged chunks or without doing memory access to the user owned part. Internal interface contracts: sysmalloc: Returns untagged memory. _int_malloc: Returns untagged memory. _int_free: Takes untagged memory. _int_memalign: Returns untagged memory. _int_realloc: Takes and returns tagged memory. So only _int_realloc and functions outside this list need care. Alignment checks do not need the right tag and tcache works with untagged memory. tag_at was kept in realloc after an mremap, which is not strictly necessary, since the pointer is only used to retag the memory, but this way the tag is guaranteed to be different from the old tag. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Use different tag after mremapSzabolcs Nagy2021-03-261-1/+1
| | | | | | | | The comment explained why different tag is used after mremap, but for that correctly tagged pointer should be passed to tag_new_usable. Use chunk2mem to get the tag. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Use memsize instead of CHUNK_AVAILABLE_SIZESzabolcs Nagy2021-03-262-26/+24
| | | | | | | | | | | | | | | This is a pure refactoring change that does not affect behaviour. The CHUNK_AVAILABLE_SIZE name was unclear, the memsize name tries to follow the existing convention of mem denoting the allocation that is handed out to the user, while chunk is its internally used container. The user owned memory for a given chunk starts at chunk2mem(p) and the size is memsize(p). It is not valid to use on dumped heap chunks. Moved the definition next to other chunk and mem related macros. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Use mtag_enabled instead of USE_MTAGSzabolcs Nagy2021-03-262-12/+8
| | | | | | | | | Use the runtime check where possible: it should not cause slow down in the !USE_MTAG case since then mtag_enabled is constant false, but it allows compiling the tagging logic so it's less likely to break or diverge when developers only test the !USE_MTAG case. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Use branches instead of mtag_granule_maskSzabolcs Nagy2021-03-262-21/+14
| | | | | | | | | | | | | The branches may be better optimized since mtag_enabled is widely used. Granule size larger than a chunk header is not supported since then we cannot have both the chunk header and user area granule aligned. To fix that for targets with large granule, the chunk layout has to change. So code that attempted to handle the granule mask generally was changed. This simplified CHUNK_AVAILABLE_SIZE and the logic in malloc_usable_size. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Change calloc when tagging is disabledSzabolcs Nagy2021-03-261-6/+4
| | | | | | | | | | | | When glibc is built with memory tagging support (USE_MTAG) but it is not enabled at runtime (mtag_enabled) then unconditional memset was used even though that can be often avoided. This is for performance when tagging is supported but not enabled. The extra check should have no overhead: tag_new_zero_region already had a runtime check which the compiler can now optimize away. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Only support zeroing and not arbitrary memset with mtagSzabolcs Nagy2021-03-261-9/+8
| | | | | | | | | | The memset api is suboptimal and does not provide much benefit. Memory tagging only needs a zeroing memset (and only for memory that's sized and aligned to multiples of the tag granule), so change the internal api and the target hooks accordingly. This is to simplify the implementation of the target hook. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Use global flag instead of function pointer dispatch for mtagSzabolcs Nagy2021-03-262-52/+39
| | | | | | | | | | | | | | | | | | A flag check can be faster than function pointers because of how branch prediction and speculation works and it can also remove a layer of indirection when there is a mismatch between the malloc internal tag_* api and __libc_mtag_* target hooks. Memory tagging wrapper functions are moved to malloc.c from arena.c and the logic now checks mmap_enabled. The definition of tag_new_usable is moved after chunk related definitions. This refactoring also allows using mtag_enabled checks instead of USE_MTAG ifdefs when memory tagging support only changes code logic when memory tagging is enabled at runtime. Note: an "if (false)" code block is optimized away even at -O0 by gcc. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Refactor TAG_ macros to avoid indirectionSzabolcs Nagy2021-03-263-56/+51
| | | | | | | | | | | This does not change behaviour, just removes one layer of indirection in the internal memory tagging logic. Use tag_ and mtag_ prefixes instead of __tag_ and __mtag_ since these are all symbols with internal linkage, private to malloc.c, so there is no user namespace pollution issue. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Avoid taggig mmaped memory on freeSzabolcs Nagy2021-03-261-3/+4
| | | | | | | | | | Either the memory belongs to the dumped area, in which case we don't want to tag (the dumped area has the same tag as malloc internal data so tagging is unnecessary, but chunks there may not have the right alignment for the tag granule), or the memory will be unmapped immediately (and thus tagging is not useful). Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Simplify __mtag_tag_new_usableSzabolcs Nagy2021-03-261-5/+0
| | | | | | | | | The chunk cannot be a dumped one here. The only non-obvious cases are free and realloc which may be called on a dumped area chunk, but in both cases it can be verified that tagging is already avoided for dumped area chunks. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Move MTAG_MMAP_FLAGS definitionSzabolcs Nagy2021-03-261-0/+2
| | | | | | | This is only used internally in malloc.c, the extern declaration was wrong, __mtag_mmap_flags has internal linkage. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Fix a potential realloc issue with memory taggingSzabolcs Nagy2021-03-261-7/+7
| | | | | | | | | | | | At an _int_free call site in realloc the wrong size was used for tag clearing: the chunk header of the next chunk was also cleared which in practice may work, but logically wrong. The tag clearing is moved before the memcpy to save a tag computation, this avoids a chunk2mem. Another chunk2mem is removed because newmem does not have to be recomputed. Whitespaces got fixed too. Reviewed-by: DJ Delorie <dj@redhat.com>
* malloc: Fix a realloc crash with heap tagging [BZ 27468]Szabolcs Nagy2021-03-261-1/+3
| | | | | | | | | | | | _int_free must be called with a chunk that has its tag reset. This was missing in a rare case that could crash when heap tagging is enabled: when in a multi-threaded process the current arena runs out of memory during realloc, but another arena still has space to finish the realloc then _int_free was called without clearing the user allocation tags. Fixes bug 27468. Reviewed-by: DJ Delorie <dj@redhat.com>
* Support for multiple versions in versioned_symbol, compat_symbolFlorian Weimer2021-03-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This essentially folds compat_symbol_unique functionality into compat_symbol. This change eliminates the need for intermediate aliases for defining multiple symbol versions, for both compat_symbol and versioned_symbol. Some binutils versions do not suport multiple versions per symbol on some targets, so aliases are automatically introduced, similar to what compat_symbol_unique did. To reduce symbol table sizes, a configure check is added to avoid these aliases if they are not needed. The new mechanism works with data symbols as well as function symbols, due to the way an assembler-level redirect is used. It is not compatible with weak symbols for old binutils versions, which is why the definition of __malloc_initialize_hook had to be changed. This is not a loss of functionality because weak symbols do not matter to dynamic linking. The placeholder symbol needs repeating in nptl/libpthread-compat.c now that compat_symbol is used, but that seems more obvious than introducing yet another macro. A subtle difference was that compat_symbol_unique made the symbol global automatically. compat_symbol does not do this, so static had to be removed from the definition of __libpthread_version_placeholder. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* malloc: Turn tst-mallocstate into a non-internal testFlorian Weimer2021-03-092-13/+8
| | | | | | | | | compat_symbol_reference no longer needs tests-internal. Do not build the test at all for newer targets, so that no spurious UNSUPPORTED result is generated. Use compat_symbol_reference for __malloc_initialize_hook as well, eliminating the need for -rdynamic. Reviewed-by: DJ Delorie <dj@redhat.com>
* Implement <unwind-link.h> for dynamically loading the libgcc_s unwinderFlorian Weimer2021-03-011-0/+5
| | | | | | | | | | This will be used to consolidate the libgcc_s access for backtrace and pthread_cancel. Unlike the existing backtrace implementations, it provides some hardening based on pointer mangling. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* added rt to malloc/Depend [BZ #27132]Paul Zimmermann2021-02-231-0/+1
| | | | | This avoids a failure when a new glibc version is compiled with an older system librt. Patch proposed by Florian Weimer.
* malloc: Sync dynarray with gnulibAdhemerval Zanella2021-02-099-84/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It syncs with gnulib version a8bac4d49. The main changes are: - Remove the usage of anonymous union within DYNARRAY_STRUCT. - Use DYNARRAY_FREE instead of DYNARRAY_NAME (free) so that Gnulib does not change 'free' to 'rpl_free'. - Use __nonnull instead of __attribute__ ((nonnull ())). - Use __attribute_maybe_unused__ instead of __attribute__ ((unused, nonnull (1))). - Use of _Noreturn instead of _attribute__ ((noreturn)). The only difference with gnulib is: --- glibc +++ gnulib @@ -18,6 +18,7 @@ #include <dynarray.h> #include <stdio.h> +#include <stdlib.h> void __libc_dynarray_at_failure (size_t size, size_t index) @@ -27,7 +28,6 @@ __snprintf (buf, sizeof (buf), "Fatal glibc error: " "array index %zu not less than array length %zu\n", index, size); - __libc_fatal (buf); #else abort (); #endif It seems a wrong sync from gnulib (the code is used on loader and thus it requires __libc_fatal instead of abort). Checked on x86_64-linux-gnu.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-07 09:19:24 +0000