From patchwork Mon Nov 15 20:51:14 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kumar Gala X-Patchwork-Id: 71286 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from theia.denx.de (theia.denx.de [85.214.87.163]) by ozlabs.org (Postfix) with ESMTP id E8EDBB7123 for ; Tue, 16 Nov 2010 07:51:30 +1100 (EST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id EDECA283CB; Mon, 15 Nov 2010 21:51:26 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at theia.denx.de Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lsB31hCAA5Nw; Mon, 15 Nov 2010 21:51:26 +0100 (CET) Received: from theia.denx.de (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id BE715283EA; Mon, 15 Nov 2010 21:51:24 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 0DA6E283EA for ; Mon, 15 Nov 2010 21:51:23 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at theia.denx.de Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AN6UBol4AH0Z for ; Mon, 15 Nov 2010 21:51:21 +0100 (CET) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested) Received: from gate.crashing.org (gate.crashing.org [63.228.1.57]) by theia.denx.de (Postfix) with ESMTPS id 07348283CB for ; Mon, 15 Nov 2010 21:51:19 +0100 (CET) Received: from localhost (localhost.localdomain [127.0.0.1]) by gate.crashing.org (8.14.1/8.13.8) with ESMTP id oAFKpF5N014964 for ; Mon, 15 Nov 2010 14:51:16 -0600 From: Kumar Gala To: u-boot@lists.denx.de Date: Mon, 15 Nov 2010 14:51:14 -0600 Message-Id: <1289854274-7006-1-git-send-email-galak@kernel.crashing.org> X-Mailer: git-send-email 1.6.0.6 Subject: [U-Boot] [PATCH] malloc: Fix issue with calloc memory possibly being non-zero X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.9 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: u-boot-bounces@lists.denx.de Errors-To: u-boot-bounces@lists.denx.de Since we set #define MORECORE_CLEARS 1, the code assumes 'sbrk' always returns zero'd out memory. However since its possible that free() returns memory ack to sbrk() via malloc_trim we could possible get non-zero'd memory from sbrk() if it allocates back memory that was previously freed to it. There are two possible solutions to this problem. 1. change #define MORECORE_CLEARS 0 2. memset to zero memory returned to sbrk. We go with the second since the sbrk being called to free up memory should be pretty rare. The following code problems an example test to show the issue. This test code was inserted right after the call to mem_malloc_init(). we could possible get non-zero'd memory from sbrk() if it allocates back memory that was previously freed to it. There are two possible solutions to this problem. 1. change #define MORECORE_CLEARS 0 2. memset to zero memory returned to sbrk. We go with the second since the sbrk being called to free up memory should be pretty rare. The following code problems an example test to show the issue. This test code was inserted right after the call to mem_malloc_init(). ... u8 *p2; int i; printf("MALLOC TEST\n"); p1 = malloc(135176); printf("P1 = %p\n", p1); memset(p1, 0xab, 135176); free(p1); p2 = calloc(4097, 1); printf("P2 = %p %p\n", p2, p2 + 4097); for (i = 0; i < 4097; i++) { if (p2[i] != 0) printf("miscompare at byte %d got %x\n", i, p2[i]); free(p2); printf("END MALLOC TEST\n\n"); ... Signed-off-by: Kumar Gala Tested-by: Wolfgang Denk --- common/dlmalloc.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/common/dlmalloc.c b/common/dlmalloc.c index 4871f4b..e9bab09 100644 --- a/common/dlmalloc.c +++ b/common/dlmalloc.c @@ -1511,6 +1511,13 @@ void *sbrk(ptrdiff_t increment) ulong old = mem_malloc_brk; ulong new = old + increment; + /* + * if we are giving memory back make sure we clear it out since + * we set MORECORE_CLEARS to 1 + */ + if (increment < 0) + memset((void *)new, 0, -increment); + if ((new < mem_malloc_start) || (new > mem_malloc_end)) return (void *)MORECORE_FAILURE;