aboutsummaryrefslogtreecommitdiff
path: root/malloc
diff options
context:
space:
mode:
authorWilco Dijkstra <wdijkstr@arm.com>2017-10-19 18:19:55 +0100
committerWilco Dijkstra <wdijkstr@arm.com>2017-10-19 18:19:55 +0100
commitd74e6f6c0de55fc588b1ac09c88eb0fb8b8600af (patch)
treee75ef871621bf3c08b6c18bf5f31a373a37fc9a4 /malloc
parent4d916f0f12b230f49967797f98b2b613c734a047 (diff)
downloadglibc-d74e6f6c0de55fc588b1ac09c88eb0fb8b8600af.tar
glibc-d74e6f6c0de55fc588b1ac09c88eb0fb8b8600af.tar.gz
glibc-d74e6f6c0de55fc588b1ac09c88eb0fb8b8600af.tar.bz2
glibc-d74e6f6c0de55fc588b1ac09c88eb0fb8b8600af.zip
Fix deadlock in _int_free consistency check
This patch fixes a deadlock in the fastbin consistency check. If we fail the fast check due to concurrent modifications to the next chunk or system_mem, we should not lock if we already have the arena lock. Simplify the check to make it obviously correct. * malloc/malloc.c (_int_free): Fix deadlock bug in consistency check.
Diffstat (limited to 'malloc')
-rw-r--r--malloc/malloc.c21
1 files changed, 12 insertions, 9 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 6b789685ad..3d7c23917c 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4135,17 +4135,20 @@ _int_free (mstate av, mchunkptr p, int have_lock)
|| __builtin_expect (chunksize (chunk_at_offset (p, size))
>= av->system_mem, 0))
{
+ bool fail = true;
/* We might not have a lock at this point and concurrent modifications
- of system_mem might have let to a false positive. Redo the test
- after getting the lock. */
- if (!have_lock
- || ({ __libc_lock_lock (av->mutex);
- chunksize_nomask (chunk_at_offset (p, size)) <= 2 * SIZE_SZ
- || chunksize (chunk_at_offset (p, size)) >= av->system_mem;
- }))
+ of system_mem might result in a false positive. Redo the test after
+ getting the lock. */
+ if (!have_lock)
+ {
+ __libc_lock_lock (av->mutex);
+ fail = (chunksize_nomask (chunk_at_offset (p, size)) <= 2 * SIZE_SZ
+ || chunksize (chunk_at_offset (p, size)) >= av->system_mem);
+ __libc_lock_unlock (av->mutex);
+ }
+
+ if (fail)
malloc_printerr ("free(): invalid next size (fast)");
- if (! have_lock)
- __libc_lock_unlock (av->mutex);
}
free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);