Re: [PATCH] eal: fix modify data area after memset

[Thomas Monjalon <thomas@monjalon.net>]

We need a careful review here, please.


12/09/2023 11:04, Fengnan Chang:
> Let's look at this path:
> malloc_elem_free
>    ->malloc_elem_join_adjacent_free
>       ->join_elem(elem, elem->next)
> 
> 0. cur elem's pad > 0
> 1. data area memset in malloc_elem_free first.
> 2. next elem is free, try to join cur elem and next.
> 3. in join_elem, try to modify inner->size, this address had
> memset in step 1, it casue the content of addrees become non-zero.
> 
> If user call rte_zmalloc, and pick this elem, it can't get all
> zero'd memory.
> 
> Fixes: 2808a12cc053 (malloc: fix memory element size in case of padding)
> Signed-off-by: Fengnan Chang <changfengnan@bytedance.com>
> ---
>  lib/eal/common/malloc_elem.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/lib/eal/common/malloc_elem.c b/lib/eal/common/malloc_elem.c
> index 619c040aa3..93a23fa8d4 100644
> --- a/lib/eal/common/malloc_elem.c
> +++ b/lib/eal/common/malloc_elem.c
> @@ -492,7 +492,7 @@ malloc_elem_alloc(struct malloc_elem *elem, size_t size, unsigned align,
>   * be contiguous in memory.
>   */
>  static inline void
> -join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2)
> +join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2, bool update_inner)
>  {
>  	struct malloc_elem *next = elem2->next;
>  	elem1->size += elem2->size;
> @@ -502,7 +502,7 @@ join_elem(struct malloc_elem *elem1, struct malloc_elem *elem2)
>  		elem1->heap->last = elem1;
>  	elem1->next = next;
>  	elem1->dirty |= elem2->dirty;
> -	if (elem1->pad) {
> +	if (elem1->pad && update_inner) {
>  		struct malloc_elem *inner = RTE_PTR_ADD(elem1, elem1->pad);
>  		inner->size = elem1->size - elem1->pad;
>  	}
> @@ -526,7 +526,7 @@ malloc_elem_join_adjacent_free(struct malloc_elem *elem)
>  
>  		/* remove from free list, join to this one */
>  		malloc_elem_free_list_remove(elem->next);
> -		join_elem(elem, elem->next);
> +		join_elem(elem, elem->next, false);
>  
>  		/* erase header, trailer and pad */
>  		memset(erase, MALLOC_POISON, erase_len);
> @@ -550,7 +550,7 @@ malloc_elem_join_adjacent_free(struct malloc_elem *elem)
>  		malloc_elem_free_list_remove(elem->prev);
>  
>  		new_elem = elem->prev;
> -		join_elem(new_elem, elem);
> +		join_elem(new_elem, elem, false);
>  
>  		/* erase header, trailer and pad */
>  		memset(erase, MALLOC_POISON, erase_len);
> @@ -683,7 +683,7 @@ malloc_elem_resize(struct malloc_elem *elem, size_t size)
>  	 * join the two
>  	 */
>  	malloc_elem_free_list_remove(elem->next);
> -	join_elem(elem, elem->next);
> +	join_elem(elem, elem->next, true);
>  
>  	if (elem->size - new_size >= MIN_DATA_SIZE + MALLOC_ELEM_OVERHEAD) {
>  		/* now we have a big block together. Lets cut it down a bit, by splitting */
>