From: Fengnan Chang <changfengnan@bytedance.com>
To: anatoly.burakov@intel.com, dev@dpdk.org, xuemingl@mellanox.com
Subject: Re: [PATCH] eal: fix modify data area after memset
Date: Fri, 22 Sep 2023 16:12:06 +0800 [thread overview]
Message-ID: <CAPFOzZstVpa=Ypqq36dCwJh0ooKYu9EK9ku04mko-a1257tGwQ@mail.gmail.com> (raw)
In-Reply-To: <20230912090415.48709-1-changfengnan@bytedance.com>
ping
Fengnan Chang <changfengnan@bytedance.com> 于2023年9月12日周二 17:05写道:
>
> Let's look at this path:
> malloc_elem_free
> ->malloc_elem_join_adjacent_free
> ->join_elem(elem, elem->next)
>
> 0. cur elem's pad > 0
> 1. data area memset in malloc_elem_free first.
> 2. next elem is free, try to join cur elem and next.
> 3. in join_elem, try to modify inner->size, this address had
> memset in step 1, it casue the content of addrees become non-zero.
>
> If user call rte_zmalloc, and pick this elem, it can't get all
> zero'd memory.
>
> Fixes: 2808a12cc053 (malloc: fix memory element size in case of padding)
> Signed-off-by: Fengnan Chang <changfengnan@bytedance.com>
> ---
> lib/eal/common/malloc_elem.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/lib/eal/common/malloc_elem.c b/lib/eal/common/malloc_elem.c
> index 619c040aa3..93a23fa8d4 100644
> --- a/lib/eal/common/malloc_elem.c
> +++ b/lib/eal/common/malloc_elem.c
> @@ -492,7 +492,7 @@ malloc_elem_alloc(struct malloc_elem *elem, size_t size, unsigned align,
> * be contiguous in memory.
> */
> static inline void
> -join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2)
> +join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2, bool update_inner)
> {
> struct malloc_elem *next = elem2->next;
> elem1->size += elem2->size;
> @@ -502,7 +502,7 @@ join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2)
> elem1->heap->last = elem1;
> elem1->next = next;
> elem1->dirty |= elem2->dirty;
> - if (elem1->pad) {
> + if (elem1->pad && update_inner) {
> struct malloc_elem *inner = RTE_PTR_ADD(elem1, elem1->pad);
> inner->size = elem1->size - elem1->pad;
> }
> @@ -526,7 +526,7 @@ malloc_elem_join_adjacent_free(struct malloc_elem *elem)
>
> /* remove from free list, join to this one */
> malloc_elem_free_list_remove(elem->next);
> - join_elem(elem, elem->next);
> + join_elem(elem, elem->next, false);
>
> /* erase header, trailer and pad */
> memset(erase, MALLOC_POISON, erase_len);
> @@ -550,7 +550,7 @@ malloc_elem_join_adjacent_free(struct malloc_elem *elem)
> malloc_elem_free_list_remove(elem->prev);
>
> new_elem = elem->prev;
> - join_elem(new_elem, elem);
> + join_elem(new_elem, elem, false);
>
> /* erase header, trailer and pad */
> memset(erase, MALLOC_POISON, erase_len);
> @@ -683,7 +683,7 @@ malloc_elem_resize(struct malloc_elem *elem, size_t size)
> * join the two
> */
> malloc_elem_free_list_remove(elem->next);
> - join_elem(elem, elem->next);
> + join_elem(elem, elem->next, true);
>
> if (elem->size - new_size >= MIN_DATA_SIZE + MALLOC_ELEM_OVERHEAD) {
> /* now we have a big block together. Lets cut it down a bit, by splitting */
> --
> 2.20.1
>
next prev parent reply other threads:[~2023-09-22 8:12 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-12 9:04 Fengnan Chang
2023-09-22 8:12 ` Fengnan Chang [this message]
2023-10-22 20:22 ` Dmitry Kozlyuk
2023-10-23 9:07 ` [External] " Fengnan Chang
2023-10-25 16:03 ` Stephen Hemminger
2023-10-30 12:31 ` Fengnan Chang
2023-10-17 13:32 ` Thomas Monjalon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAPFOzZstVpa=Ypqq36dCwJh0ooKYu9EK9ku04mko-a1257tGwQ@mail.gmail.com' \
--to=changfengnan@bytedance.com \
--cc=anatoly.burakov@intel.com \
--cc=dev@dpdk.org \
--cc=xuemingl@mellanox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).