ソースを参照

mem: fix f_malloc big fragments bug

In some situation, when dealing with several big free fragments
(>16k) f_malloc would wrongly choose a fragment with a smaller
size then requested. This would create the impression that someone
arbitrarily overwrites the memory.

First symptoms were some tls crashes reported by
Klaus Darilion  [email protected].
Reproduced using the malloc_test module.
(cherry picked from commit c7099d0a1204120277cf662cc05ab35180d89538)
Andrei Pelinescu-Onciul 15 年 前
コミット
0822a9caf7
1 ファイル変更2 行追加2 行削除
  1. 2 2
      mem/f_malloc.c

+ 2 - 2
mem/f_malloc.c

@@ -337,7 +337,7 @@ void* fm_malloc(struct fm_block* qm, unsigned long size)
 	hash=fm_bmp_first_set(qm, GET_HASH(size));
 	if (likely(hash>=0)){
 		f=&(qm->free_hash[hash].first);
-	if (likely(hash<=F_MALLOC_OPTIMIZE)) /* return first match */
+	if (likely(hash<=F_MALLOC_OPTIMIZE/ROUNDTO)) /* return first match */
 			goto found; 
 		for(;(*f); f=&((*f)->u.nxt_free))
 			if ((*f)->size>=size) goto found;
@@ -346,7 +346,7 @@ void* fm_malloc(struct fm_block* qm, unsigned long size)
 	for(hash=GET_HASH(size);hash<F_HASH_SIZE;hash++){
 		f=&(qm->free_hash[hash].first);
 #if 0
-		if (likely(hash<=F_MALLOC_OPTIMIZE)) /* return first match */
+		if (likely(hash<=F_MALLOC_OPTIMIZE/ROUNDTO)) /* return first match */
 				goto found; 
 #endif
 		for(;(*f); f=&((*f)->u.nxt_free))