Page MenuHomeFreeBSD

malloc: do not redzone-wrap a MemGuard allocation
Needs ReviewPublic

Authored by nick_spun.io on Sun, Oct 11, 5:21 AM.
Tags
None
Referenced Files
F176084411: D60608.diff
Thu, Oct 15, 11:28 PM
Unknown Object (File)
Wed, Oct 14, 9:01 PM
Unknown Object (File)
Tue, Oct 13, 2:02 PM
Unknown Object (File)
Mon, Oct 12, 7:16 PM
Unknown Object (File)
Mon, Oct 12, 4:19 AM
Unknown Object (File)
Mon, Oct 12, 4:05 AM
Unknown Object (File)
Mon, Oct 12, 12:06 AM
Unknown Object (File)
Sun, Oct 11, 10:48 PM
Subscribers

Details

Reviewers
adrian
Summary

redzone(9) documents that it skips MemGuard allocations, and the free and
realloc paths rely on a MemGuard pointer never being redzone-wrapped. With
DEBUG_MEMGUARD and DEBUG_REDZONE both set, the UMA zone-sampling path broke
this: redzone_setup() shifted the pointer into MemGuard's metadata, so the
later memguard_free() or memguard_realloc() panicked.

Skip redzone setup for a MemGuard address, matching the by-type path and
the documented behavior.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 77995
Build 74878: arc lint + arc unit

Event Timeline

oh holy crap how'd you trip over this?

oh holy crap how'd you trip over this?

I am running sys/amd64/conf/NICK-DEV-EXTRABIGASSDEBUG

I have basically everything enabled on my workstation except of KASAN (since it doesn't play nicely with others and the performance hit is insane)