From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 08C574318A; Tue, 17 Oct 2023 15:33:07 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id DB4DA40273; Tue, 17 Oct 2023 15:33:06 +0200 (CEST) Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) by mails.dpdk.org (Postfix) with ESMTP id ED1D840270 for ; Tue, 17 Oct 2023 15:33:04 +0200 (CEST) Received: from compute6.internal (compute6.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id 53C763200A98; Tue, 17 Oct 2023 09:33:03 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Tue, 17 Oct 2023 09:33:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=monjalon.net; h= cc:cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:sender:subject:subject:to:to; s=fm3; t= 1697549582; x=1697635982; bh=lF29tUV0IkyE0HHz8rBiDP88QacbVjeqJCw Si6WC55I=; b=fZaLgOObWoG0TSqzgG1MHZrqZOyDCh3IfD2hA7sWaB8PTcbp1cN D80g+t2iGvtxXyqptLyjwPC+1tgPVuc5zkuw4s4bU/uBst0u3koCvMRWJrcPh+ym 0TR3FDWHj5HxPvWuxolSC0z2F0KbomTNrFVwq+iT6wRDcF6xgCE8YBjDRToT04/m tAA6WkYtexIOLw4TaLpuzD05ldGTrUbCq4+3gd5A+/cf1Vh/5uV9NFROyAveCgVU MRjznQrVuWWaL7ELCYMQWtZRgsRkkL2TzHvSeLYRInOYIRUGGaV0KuuPXYHzh4rq rC2/7PIgx+4VXjAwRG0wfv2BEsYPIFSHc+A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:sender:subject:subject:to:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1697549582; x=1697635982; bh=lF29tUV0IkyE0HHz8rBiDP88QacbVjeqJCw Si6WC55I=; b=gSfYAqpjvS/ALZyzL1UOg1hrWXMtC/vvgE4GEprWADrc1WI+Xv9 OWGMzBh8ErwTH6dV2oSVzAWnN6ZPAM0+NQsm16ASa9GMhm9C/0tYUjIBGKTxgm3V yak47Mqt7avgr812m4GND/T7S71RtYYZl+xwUaS18WBDUoTQtQ14+yv2XDjxKx/9 65JkZlEbrQVUb0htPvxqpUBykIp1Raf8xK+DFymB5XKKnMJXNMVGk2v12WrR18fM AO3Hj555PcZdwIRgDLQDzcxAZCZGDqgNFctIo+TvhOL6fMU9CS4vL3XTwIaPQGDZ Nm04L1MO9Q2oKdlkLA2vr2NJESffZ+BW9RQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvkedrjedvgdeigecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefhvfevufffkfgjfhgggfgtsehtufertddttddvnecuhfhrohhmpefvhhhomhgr shcuofhonhhjrghlohhnuceothhhohhmrghssehmohhnjhgrlhhonhdrnhgvtheqnecugg ftrfgrthhtvghrnheptdejieeifeehtdffgfdvleetueeffeehueejgfeuteeftddtieek gfekudehtdfgnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrh homhepthhhohhmrghssehmohhnjhgrlhhonhdrnhgvth X-ME-Proxy: Feedback-ID: i47234305:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 17 Oct 2023 09:33:00 -0400 (EDT) From: Thomas Monjalon To: anatoly.burakov@intel.com Cc: dev@dpdk.org, xuemingl@mellanox.com, Fengnan Chang , dmitry.kozliuk@gmail.com, Morten =?ISO-8859-1?Q?Br=F8rup?= , stephen@networkplumber.org, bruce.richardson@intel.com, david.marchand@redhat.com Subject: Re: [PATCH] eal: fix modify data area after memset Date: Tue, 17 Oct 2023 15:32:59 +0200 Message-ID: <3967994.ZaRXLXkqSa@thomas> In-Reply-To: <20230912090415.48709-1-changfengnan@bytedance.com> References: <20230912090415.48709-1-changfengnan@bytedance.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org We need a careful review here, please. 12/09/2023 11:04, Fengnan Chang: > Let's look at this path: > malloc_elem_free > ->malloc_elem_join_adjacent_free > ->join_elem(elem, elem->next) > > 0. cur elem's pad > 0 > 1. data area memset in malloc_elem_free first. > 2. next elem is free, try to join cur elem and next. > 3. in join_elem, try to modify inner->size, this address had > memset in step 1, it casue the content of addrees become non-zero. > > If user call rte_zmalloc, and pick this elem, it can't get all > zero'd memory. > > Fixes: 2808a12cc053 (malloc: fix memory element size in case of padding) > Signed-off-by: Fengnan Chang > --- > lib/eal/common/malloc_elem.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/lib/eal/common/malloc_elem.c b/lib/eal/common/malloc_elem.c > index 619c040aa3..93a23fa8d4 100644 > --- a/lib/eal/common/malloc_elem.c > +++ b/lib/eal/common/malloc_elem.c > @@ -492,7 +492,7 @@ malloc_elem_alloc(struct malloc_elem *elem, size_t size, unsigned align, > * be contiguous in memory. > */ > static inline void > -join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2) > +join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2, bool update_inner) > { > struct malloc_elem *next = elem2->next; > elem1->size += elem2->size; > @@ -502,7 +502,7 @@ join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2) > elem1->heap->last = elem1; > elem1->next = next; > elem1->dirty |= elem2->dirty; > - if (elem1->pad) { > + if (elem1->pad && update_inner) { > struct malloc_elem *inner = RTE_PTR_ADD(elem1, elem1->pad); > inner->size = elem1->size - elem1->pad; > } > @@ -526,7 +526,7 @@ malloc_elem_join_adjacent_free(struct malloc_elem *elem) > > /* remove from free list, join to this one */ > malloc_elem_free_list_remove(elem->next); > - join_elem(elem, elem->next); > + join_elem(elem, elem->next, false); > > /* erase header, trailer and pad */ > memset(erase, MALLOC_POISON, erase_len); > @@ -550,7 +550,7 @@ malloc_elem_join_adjacent_free(struct malloc_elem *elem) > malloc_elem_free_list_remove(elem->prev); > > new_elem = elem->prev; > - join_elem(new_elem, elem); > + join_elem(new_elem, elem, false); > > /* erase header, trailer and pad */ > memset(erase, MALLOC_POISON, erase_len); > @@ -683,7 +683,7 @@ malloc_elem_resize(struct malloc_elem *elem, size_t size) > * join the two > */ > malloc_elem_free_list_remove(elem->next); > - join_elem(elem, elem->next); > + join_elem(elem, elem->next, true); > > if (elem->size - new_size >= MIN_DATA_SIZE + MALLOC_ELEM_OVERHEAD) { > /* now we have a big block together. Lets cut it down a bit, by splitting */ >