Skip to content

Commit

Permalink
F_MALLOC: Recover from double pointer free
Browse files Browse the repository at this point in the history
This patch makes F_MALLOC more robust in production by avoiding memory
corruption in case of double free operations. Previously, the hash state
would immediately get corrupted on such operations, and it would only be
a matter of time before the allocator would crash in some random place
with a useless backtrace resembling:

\#0  0x0000000000507209 in fm_remove_free (qm=0x7f7d578d2010, size=56) at
mem/f_malloc.c:200
200          *pf=n->u.nxt_free;

When DBG_MALLOC is defined, F_MALLOC will now abort() on a double free,
similar to QM_MALLOC.

(cherry picked from commit 2254d00)
(cherry picked from commit cabb4c0)
  • Loading branch information
liviuchircu committed Feb 16, 2018
1 parent fea96eb commit 81196e1
Showing 1 changed file with 12 additions and 0 deletions.
12 changes: 12 additions & 0 deletions mem/f_malloc.c
Expand Up @@ -484,6 +484,18 @@ void fm_free(struct fm_block* qm, void* p)
}
f=(struct fm_frag*) ((char*)p-sizeof(struct fm_frag));

#ifndef F_MALLOC_OPTIMIZATIONS
if (f->prev) {
#ifdef DBG_MALLOC
LM_CRIT("freeing already freed pointer (%p), first free: "
"%s: %s(%ld) - aborting\n", p, f->file, f->func, f->line);
abort();
#else
LM_CRIT("freeing already freed pointer (%p) - skipping!\n", p);
return;
#endif
}
#endif
#ifdef DBG_MALLOC
LM_GEN1(memlog, "freeing block alloc'ed from %s: %s(%ld)\n", f->file, f->func,
f->line);
Expand Down

0 comments on commit 81196e1

Please sign in to comment.