Skip to content

Ensure we do not try to address 0 with MAP_FIXED. #465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
copybara-service merged 1 commit into from
Aug 6, 2026
Merged

Ensure we do not try to address 0 with MAP_FIXED. #465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions tcmalloc/internal/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1326,6 +1326,7 @@ cc_test(
deps = [
":allocation_guard",
":config",
":exponential_biased",
":logging",
":numa",
":proc_maps",
Expand All @@ -1351,6 +1352,7 @@ cc_test(
deps = [
":allocation_guard",
":config",
":exponential_biased",
":logging",
":numa",
":proc_maps",
Expand Down
10 changes: 6 additions & 4 deletions tcmalloc/internal/exponential_biased.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ namespace tcmalloc_internal {

class ExponentialBiased {
public:
static uint64_t NextRandom(uint64_t rnd);
static uint32_t GetRandom(uint64_t rnd);
static constexpr uint64_t NextRandom(uint64_t rnd);
static constexpr uint32_t GetRandom(uint64_t rnd);
};

// Returns the next prng value.
// pRNG is: aX+b mod c with a = 0x5DEECE66D, b = 0xB, c = 1<<48
// This is the lrand64 generator.
inline uint64_t ExponentialBiased::NextRandom(uint64_t rnd) {
inline constexpr uint64_t ExponentialBiased::NextRandom(uint64_t rnd) {
const uint64_t prng_mult = UINT64_C(0x5DEECE66D);
const uint64_t prng_add = 0xB;
const uint64_t prng_mod_power = 48;
Expand All @@ -42,7 +42,9 @@ inline uint64_t ExponentialBiased::NextRandom(uint64_t rnd) {
// Extracts higher-quality random bits.
// The raw value returned from NextRandom has poor randomness low bits
// and is not directly suitable for things like 'if (rnd % 2)'.
inline uint32_t ExponentialBiased::GetRandom(uint64_t rnd) { return rnd >> 16; }
inline constexpr uint32_t ExponentialBiased::GetRandom(uint64_t rnd) {
return rnd >> 16;
}

// Convenience wrapper to initialize a seed and return a sequence of
// pseudo-random values. Thread-safety: thread safe.
Expand Down
8 changes: 2 additions & 6 deletions tcmalloc/internal/system_allocator.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,6 @@
#define MAP_ANONYMOUS MAP_ANON
#endif

#ifndef MAP_FIXED_NOREPLACE
#define MAP_FIXED_NOREPLACE 0x100000
#endif

GOOGLE_MALLOC_SECTION_BEGIN
namespace tcmalloc::tcmalloc_internal::system_allocator_internal {

Expand Down Expand Up @@ -81,7 +77,7 @@ int MapFixedNoReplaceFlagAvailable() {
void* target = reinterpret_cast<void*>(uptr - page_size);

void* ptr2 = mmap(target, 2 * page_size, PROT_NONE,
MAP_FIXED_NOREPLACE | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
kMapFixedNoReplace | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
const bool rejected = ptr2 == MAP_FAILED;
if (!rejected) {
if (ptr2 == target) {
Expand All @@ -95,7 +91,7 @@ int MapFixedNoReplaceFlagAvailable() {
}
munmap(ptr, page_size);

noreplace_flag = rejected ? MAP_FIXED_NOREPLACE : 0;
noreplace_flag = rejected ? kMapFixedNoReplace : 0;
});

return noreplace_flag;
Expand Down
15 changes: 12 additions & 3 deletions tcmalloc/internal/system_allocator.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,10 @@
#define PR_SET_VMA_ANON_NAME 0
#endif

#ifndef MAP_FIXED_NOREPLACE
#define MAP_FIXED_NOREPLACE 0x100000
#endif

GOOGLE_MALLOC_SECTION_BEGIN
namespace tcmalloc {
namespace tcmalloc_internal {
Expand Down Expand Up @@ -296,6 +300,8 @@ inline size_t RoundUp(const size_t size, const size_t alignment) {

int MapFixedNoReplaceFlagAvailable();

inline constexpr int kMapFixedNoReplace = MAP_FIXED_NOREPLACE;

} // namespace system_allocator_internal

template <typename Topology, size_t NormalPartitions>
Expand Down Expand Up @@ -804,9 +810,12 @@ uintptr_t SystemAllocator<Topology, NormalPartitions>::RandomMmapHint(
// tag.
alignment = absl::bit_ceil(std::max(alignment, size));

rnd_ = ExponentialBiased::NextRandom(rnd_);
uintptr_t addr = rnd_ & kAddrMask & ~(alignment - 1) & ~kTagMask;
addr |= static_cast<uintptr_t>(tag) << kTagShift;
uintptr_t addr;
do {
rnd_ = ExponentialBiased::NextRandom(rnd_);
addr = rnd_ & kAddrMask & ~(alignment - 1) & ~kTagMask;
addr |= static_cast<uintptr_t>(tag) << kTagShift;
} while (addr == 0);

#if defined(ABSL_HAVE_THREAD_SANITIZER)
#if defined(__x86_64__)
Expand Down
2 changes: 2 additions & 0 deletions tcmalloc/internal/system_allocator_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
#include <sys/mman.h>
#include <sys/prctl.h>

#include <atomic>
#include <limits>
#include <optional>
#include <string>
Expand All @@ -33,6 +34,7 @@
#include "absl/strings/string_view.h"
#include "tcmalloc/internal/allocation_guard.h"
#include "tcmalloc/internal/config.h"
#include "tcmalloc/internal/exponential_biased.h"
#include "tcmalloc/internal/logging.h"
#include "tcmalloc/internal/numa.h"
#include "tcmalloc/internal/proc_maps.h"
Expand Down
Loading