Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[kernel] Experimental heap_free valitity checks #107

Merged
merged 2 commits into from
Nov 24, 2024
Merged

[kernel] Experimental heap_free valitity checks #107

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da7489f
[kernel] Experimental heap_free valitity checks
Mellvik Nov 23, 2024
7805da0
[heap] Simplify and cleanup!
Mellvik Nov 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tlvc/include/linuxmt/heap.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ struct heap {
list_s free;
word_t size;
byte_t tag;
byte_t unused;
byte_t canary;
};

typedef struct heap heap_s;
Expand Down
33 changes: 32 additions & 1 deletion tlvc/lib/heap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@
#define HEAP_MIN_SIZE (sizeof (heap_s) + 16)
#define HEAP_SEG_OPT /* allocate small SEG descriptors from the upper */
/* end of the heap to reduce fragmentation */
#define HEAP_CANARY 0xA5U /* for header validation */
//#define HEAPFREE_VALIDATE_1
#define HEAPFREE_VALIDATE_2

#define HEAP_DEBUG 0
#if HEAP_DEBUG
Expand Down Expand Up @@ -105,6 +108,7 @@ static heap_s *free_get(word_t size0, byte_t tag)
list_remove(&(best_h->free));
}
best_h->tag = HEAP_TAG_USED | tag;
best_h->canary = HEAP_CANARY;
}
#ifdef HEAP_SEG_OPT
debug_heap("highfree: %x/%u, tag 0x%x\n", high_free, high_free->size, tag);
Expand All @@ -118,6 +122,7 @@ static heap_s *free_get(word_t size0, byte_t tag)
static void heap_merge(heap_s *h1, heap_s *h2)
{
h1->size = h1->size + sizeof(heap_s) + h2->size;
h2->canary = 0;
list_remove(&(h2->all));
}

Expand Down Expand Up @@ -150,8 +155,34 @@ void heap_free(void *data)
// chance on next allocation of same size

list_s *i = &_heap_free;
list_s *n;
debug_heap("free 0x%x/%u; ", h, h->size);

#ifdef HEAPFREE_VALIDATE_1
/* Sanity check */
heap_s *this;
n = _heap_all.prev;
while (n != &_heap_all) {
this = structof(n, heap_s, all);
//printk("this+1 %x data %x tag %x\n", this+1, data, this->tag);
if ((this->tag & HEAP_TAG_USED) && data == (this+1))
break;
n = n->prev; /* going backwards is slightly faster */
}
if (n == &_heap_all) {
printk("WARNING: bogus heap_free");
return;
}
#endif

#ifdef HEAPFREE_VALIDATE_2
//printk("Heap canary %x\n", *((char *)data - 1)&0xff);
if ((*((char *)data - 1)&0xff) != HEAP_CANARY) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't you just use if (h->canary != HEAP_CANARY) here rather than using complicated pointer arithmetic that also assumes canary is the last struct member?

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not my day! Thanks.

printk("WARNING: bogus heap_free");
return;
}
#endif

// Try to merge with previous block if free

list_s *p = h->all.prev;
Expand All @@ -169,7 +200,7 @@ void heap_free(void *data)

// Try to merge with next block if free

list_s *n = h->all.next;
n = h->all.next;
if (n != &_heap_all) {
heap_s *next = structof(n, heap_s, all);
if (next->tag == HEAP_TAG_FREE) {
Expand Down