You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
167 lines
5.9 KiB
167 lines
5.9 KiB
diff -Nru glibc-2.17-c758a686/malloc/arena.c glibc-2.17-c758a686/malloc/arena.c |
|
--- glibc-2.17-c758a686/malloc/arena.c 2012-05-29 16:45:53.000000000 -0600 |
|
+++ glibc-2.17-c758a686/malloc/arena.c 2012-05-30 00:13:40.683514016 -0600 |
|
@@ -673,7 +673,7 @@ heap_trim(heap_info *heap, size_t pad) |
|
heap = prev_heap; |
|
if(!prev_inuse(p)) { /* consolidate backward */ |
|
p = prev_chunk(p); |
|
- unlink(p, bck, fwd); |
|
+ unlink(ar_ptr, p, bck, fwd); |
|
} |
|
assert(((unsigned long)((char*)p + new_size) & (pagesz-1)) == 0); |
|
assert( ((char*)p + new_size) == ((char*)heap + heap->size) ); |
|
diff -Nru glibc-2.17-c758a686/malloc/hooks.c glibc-2.17-c758a686/malloc/hooks.c |
|
--- glibc-2.17-c758a686/malloc/hooks.c 2012-05-29 16:45:53.000000000 -0600 |
|
+++ glibc-2.17-c758a686/malloc/hooks.c 2012-05-30 00:13:40.684514011 -0600 |
|
@@ -191,7 +191,9 @@ top_check(void) |
|
(char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem))) |
|
return 0; |
|
|
|
+ mutex_unlock(&main_arena); |
|
malloc_printerr (check_action, "malloc: top chunk is corrupt", t); |
|
+ mutex_lock(&main_arena); |
|
|
|
/* Try to set up a new top chunk. */ |
|
brk = MORECORE(0); |
|
diff -Nru glibc-2.17-c758a686/malloc/malloc.c glibc-2.17-c758a686/malloc/malloc.c |
|
--- glibc-2.17-c758a686/malloc/malloc.c 2012-05-29 16:45:53.000000000 -0600 |
|
+++ glibc-2.17-c758a686/malloc/malloc.c 2012-05-30 00:13:40.686514001 -0600 |
|
@@ -1424,12 +1424,14 @@ typedef struct malloc_chunk* mbinptr; |
|
#define last(b) ((b)->bk) |
|
|
|
/* Take a chunk off a bin list */ |
|
-#define unlink(P, BK, FD) { \ |
|
+#define unlink(AV, P, BK, FD) { \ |
|
FD = P->fd; \ |
|
BK = P->bk; \ |
|
- if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) \ |
|
+ if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) { \ |
|
+ mutex_unlock(&(AV)->mutex); \ |
|
malloc_printerr (check_action, "corrupted double-linked list", P); \ |
|
- else { \ |
|
+ mutex_lock(&(AV)->mutex); \ |
|
+ } else { \ |
|
FD->bk = BK; \ |
|
BK->fd = FD; \ |
|
if (!in_smallbin_range (P->size) \ |
|
@@ -2511,7 +2513,9 @@ static void* sysmalloc(INTERNAL_SIZE_T n |
|
|
|
else if (contiguous(av) && old_size && brk < old_end) { |
|
/* Oops! Someone else killed our space.. Can't touch anything. */ |
|
+ mutex_unlock(&av->mutex); |
|
malloc_printerr (3, "break adjusted to free malloc space", brk); |
|
+ mutex_lock(&av->mutex); |
|
} |
|
|
|
/* |
|
@@ -3345,7 +3349,9 @@ _int_malloc(mstate av, size_t bytes) |
|
{ |
|
errstr = "malloc(): memory corruption (fast)"; |
|
errout: |
|
+ mutex_unlock(&av->mutex); |
|
malloc_printerr (check_action, errstr, chunk2mem (victim)); |
|
+ mutex_lock(&av->mutex); |
|
return NULL; |
|
} |
|
check_remalloced_chunk(av, victim, nb); |
|
@@ -3430,8 +3436,12 @@ _int_malloc(mstate av, size_t bytes) |
|
bck = victim->bk; |
|
if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0) |
|
|| __builtin_expect (victim->size > av->system_mem, 0)) |
|
- malloc_printerr (check_action, "malloc(): memory corruption", |
|
- chunk2mem (victim)); |
|
+ { |
|
+ void *p = chunk2mem(victim); |
|
+ mutex_unlock(&av->mutex); |
|
+ malloc_printerr (check_action, "malloc(): memory corruption", p); |
|
+ mutex_lock(&av->mutex); |
|
+ } |
|
size = chunksize(victim); |
|
|
|
/* |
|
@@ -3572,7 +3582,7 @@ _int_malloc(mstate av, size_t bytes) |
|
victim = victim->fd; |
|
|
|
remainder_size = size - nb; |
|
- unlink(victim, bck, fwd); |
|
+ unlink(av, victim, bck, fwd); |
|
|
|
/* Exhaust */ |
|
if (remainder_size < MINSIZE) { |
|
@@ -3670,7 +3680,7 @@ _int_malloc(mstate av, size_t bytes) |
|
remainder_size = size - nb; |
|
|
|
/* unlink */ |
|
- unlink(victim, bck, fwd); |
|
+ unlink(av, victim, bck, fwd); |
|
|
|
/* Exhaust */ |
|
if (remainder_size < MINSIZE) { |
|
@@ -3805,9 +3815,11 @@ _int_free(mstate av, mchunkptr p, int ha |
|
{ |
|
errstr = "free(): invalid pointer"; |
|
errout: |
|
- if (! have_lock && locked) |
|
+ if (have_lock || locked) |
|
(void)mutex_unlock(&av->mutex); |
|
malloc_printerr (check_action, errstr, chunk2mem(p)); |
|
+ if (have_lock) |
|
+ mutex_lock(&av->mutex); |
|
return; |
|
} |
|
/* We know that each chunk is at least MINSIZE bytes in size or a |
|
@@ -3952,7 +3964,7 @@ _int_free(mstate av, mchunkptr p, int ha |
|
prevsize = p->prev_size; |
|
size += prevsize; |
|
p = chunk_at_offset(p, -((long) prevsize)); |
|
- unlink(p, bck, fwd); |
|
+ unlink(av, p, bck, fwd); |
|
} |
|
|
|
if (nextchunk != av->top) { |
|
@@ -3961,7 +3973,7 @@ _int_free(mstate av, mchunkptr p, int ha |
|
|
|
/* consolidate forward */ |
|
if (!nextinuse) { |
|
- unlink(nextchunk, bck, fwd); |
|
+ unlink(av, nextchunk, bck, fwd); |
|
size += nextsize; |
|
} else |
|
clear_inuse_bit_at_offset(nextchunk, 0); |
|
@@ -4122,7 +4134,7 @@ static void malloc_consolidate(mstate av |
|
prevsize = p->prev_size; |
|
size += prevsize; |
|
p = chunk_at_offset(p, -((long) prevsize)); |
|
- unlink(p, bck, fwd); |
|
+ unlink(av, p, bck, fwd); |
|
} |
|
|
|
if (nextchunk != av->top) { |
|
@@ -4130,7 +4142,7 @@ static void malloc_consolidate(mstate av |
|
|
|
if (!nextinuse) { |
|
size += nextsize; |
|
- unlink(nextchunk, bck, fwd); |
|
+ unlink(av, nextchunk, bck, fwd); |
|
} else |
|
clear_inuse_bit_at_offset(nextchunk, 0); |
|
|
|
@@ -4199,7 +4211,9 @@ _int_realloc(mstate av, mchunkptr oldp, |
|
{ |
|
errstr = "realloc(): invalid old size"; |
|
errout: |
|
+ mutex_unlock(&av->mutex); |
|
malloc_printerr (check_action, errstr, chunk2mem(oldp)); |
|
+ mutex_lock(&av->mutex); |
|
return NULL; |
|
} |
|
|
|
@@ -4241,7 +4255,7 @@ _int_realloc(mstate av, mchunkptr oldp, |
|
(unsigned long)(newsize = oldsize + nextsize) >= |
|
(unsigned long)(nb)) { |
|
newp = oldp; |
|
- unlink(next, bck, fwd); |
|
+ unlink(av, next, bck, fwd); |
|
} |
|
|
|
/* allocate, copy, free */
|
|
|