glibc/malloc
Mel Gorman f8ef472c0f malloc: Do not corrupt the top of a threaded heap if top chunk is MINSIZE [BZ #18502]
mksquashfs was reported in openSUSE to be causing segmentation faults when
creating installation images. Testing showed that mksquashfs sometimes
failed and could be reproduced within 10 attempts. The core dump looked
like the heap top was corrupted and was pointing to an unmapped area. In
other cases, this has been due to an application corrupting glibc structures
but mksquashfs appears to be fine in this regard.

The problem is that heap_trim is "growing" the top into unmapped space.
If the top chunk == MINSIZE then top_area is -1 and this check does not
behave as expected due to a signed/unsigned comparison

  if (top_area <= pad)
    return 0;

The next calculation extra = ALIGN_DOWN(top_area - pad, pagesz) calculates
extra as a negative number which also is unnoticed due to a signed/unsigned
comparison. We then call shrink_heap(heap, negative_number) which crashes
later. This patch adds a simple check against MINSIZE to make sure extra
does not become negative. It adds a cast to hint to the reader that this
is a signed vs unsigned issue.

Without the patch, mksquash fails within 10 attempts. With it applied, it
completed 1000 times without error. The standard test suite "make check"
showed no changes in the summary of test results.
2015-06-26 22:47:45 +02:00
..
arena.c malloc: Do not corrupt the top of a threaded heap if top chunk is MINSIZE [BZ #18502] 2015-06-26 22:47:45 +02:00
Depend Update. 1999-10-04 22:59:43 +00:00
hooks.c Fix for test "malloc_usable_size: expected 7 but got 11" 2015-05-19 12:10:26 -07:00
Makefile Avoid deadlock in malloc on backtrace (BZ #16159) 2015-05-19 06:40:38 +05:30
malloc.c Avoid deadlock in malloc on backtrace (BZ #16159) 2015-05-19 06:40:38 +05:30
malloc.h Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
mallocbug.c Reformat malloc to gnu style. 2014-01-02 09:40:10 +01:00
mcheck-init.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
mcheck.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
mcheck.h Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
memusage.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
memusage.sh Update copyright dates not handled by scripts/update-copyrights. 2015-01-02 16:54:45 +00:00
memusagestat.c Update copyright dates not handled by scripts/update-copyrights. 2015-01-02 16:54:45 +00:00
morecore.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
mtrace.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
mtrace.pl Update copyright dates not handled by scripts/update-copyrights. 2015-01-02 16:54:45 +00:00
obstack.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
obstack.h Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
scratch_buffer_grow_preserve.c scratch_buffer_grow_preserve: Add missing #include <string.h> 2015-04-07 17:46:58 +02:00
scratch_buffer_grow.c Add struct scratch_buffer and its internal helper functions 2015-04-07 11:03:43 +02:00
scratch_buffer_set_array_size.c Add struct scratch_buffer and its internal helper functions 2015-04-07 11:03:43 +02:00
set-freeres.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
thread-freeres.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-calloc.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-malloc-backtrace.c Avoid outputting to TTY after an expected memory corruption in testcase 2015-06-05 09:39:49 -03:00
tst-malloc-usable.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-malloc.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-mallocfork.c * malloc/tst-mallocfork.c (do_test): Make sure sa_flags is 2005-12-06 00:50:15 +00:00
tst-mallocstate.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-mallopt.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-mcheck.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-memalign.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-mtrace.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-mtrace.sh Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-obstack.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tst-posix_memalign.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-pvalloc.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-realloc.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
tst-scratch_buffer.c scratch_buffer: Suppress truncation warning on 32-bit 2015-04-09 17:12:42 +02:00
tst-trim1.c * malloc/tst-trim1.c: New file. 2007-12-16 22:57:57 +00:00
tst-valloc.c Update copyright dates with scripts/update-copyrights. 2015-01-02 16:29:47 +00:00
Versions Add struct scratch_buffer and its internal helper functions 2015-04-07 11:03:43 +02:00