[U-Boot] [PATCH v2] malloc: Fix issue with calloc memory possibly being non-zero

[U-Boot] [PATCH v2] malloc: Fix issue with calloc memory possibly being non-zero

[Kumar Gala]

Since we set #define MORECORE_CLEARS 1, the code assumes 'sbrk' always
returns zero'd out memory.  However since its possible that free()
returns memory back to sbrk() via malloc_trim we could possible get
non-zero'd memory from sbrk().  This is a problem for when code might
call calloc() and expect the memory to have been zero'd out.

There are two possible solutions to this problem.
1. change #define MORECORE_CLEARS 0
2. memset to zero memory returned to sbrk.

We go with the second since the sbrk being called to free up memory
should be pretty rare.

The following code problems an example test to show the issue.  This
test code was inserted right after the call to mem_malloc_init().

...
       u8 *p2;
       int i;

       printf("MALLOC TEST\n");
       p1 = malloc(135176);
       printf("P1 = %p\n", p1);
       memset(p1, 0xab, 135176);

       free(p1);
       p2 = calloc(4097, 1);
       printf("P2 = %p %p\n", p2, p2 + 4097);

       for (i = 0; i < 4097; i++) {
	       if (p2[i] != 0)
		       printf("miscompare at byte %d got %x\n", i, p2[i]);

       free(p2);
       printf("END MALLOC TEST\n\n");
...

Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Tested-by: Wolfgang Denk <wd@denx.de>
---
* Fix commit message screw up

 common/dlmalloc.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index 4871f4b..e9bab09 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -1511,6 +1511,13 @@ void *sbrk(ptrdiff_t increment)
 	ulong old = mem_malloc_brk;
 	ulong new = old + increment;
 
+	/*
+	 * if we are giving memory back make sure we clear it out since
+	 * we set MORECORE_CLEARS to 1
+	 */
+	if (increment < 0)
+		memset((void *)new, 0, -increment);
+
 	if ((new < mem_malloc_start) || (new > mem_malloc_end))
 		return (void *)MORECORE_FAILURE;
 
-- 
1.7.2.3

[U-Boot] [PATCH v2] malloc: Fix issue with calloc memory possibly being non-zero

[Wolfgang Denk]

Dear Kumar Gala,

In message <1289868103-7702-1-git-send-email-galak@kernel.crashing.org> you wrote:
> Since we set #define MORECORE_CLEARS 1, the code assumes 'sbrk' always
> returns zero'd out memory.  However since its possible that free()
> returns memory back to sbrk() via malloc_trim we could possible get
> non-zero'd memory from sbrk().  This is a problem for when code might
> call calloc() and expect the memory to have been zero'd out.
> 
> There are two possible solutions to this problem.
> 1. change #define MORECORE_CLEARS 0
> 2. memset to zero memory returned to sbrk.
> 
> We go with the second since the sbrk being called to free up memory
> should be pretty rare.
> 
> The following code problems an example test to show the issue.  This
> test code was inserted right after the call to mem_malloc_init().
> 
> ...
>        u8 *p2;
>        int i;
> 
>        printf("MALLOC TEST\n");
>        p1 = malloc(135176);
>        printf("P1 = %p\n", p1);
>        memset(p1, 0xab, 135176);
> 
>        free(p1);
>        p2 = calloc(4097, 1);
>        printf("P2 = %p %p\n", p2, p2 + 4097);
> 
>        for (i = 0; i < 4097; i++) {
> 	       if (p2[i] != 0)
> 		       printf("miscompare at byte %d got %x\n", i, p2[i]);
> 
>        free(p2);
>        printf("END MALLOC TEST\n\n");
> ...
> 
> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
> Tested-by: Wolfgang Denk <wd@denx.de>
> ---
> * Fix commit message screw up
> 
>  common/dlmalloc.c |    7 +++++++
>  1 files changed, 7 insertions(+), 0 deletions(-)

Applied, thanks.

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
Memories of you remind me of you.                   - Karl Lehenbauer