author | Shawn Walker-Salas <shawn.walker@oracle.com> |
Thu, 14 Apr 2016 12:48:37 -0700 | |
changeset 5781 | ecbdf40c0a37 |
parent 5331 | 9c955076ffe3 |
permissions | -rw-r--r-- |
5331
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
1 |
From a10b27094cbddd7d470281590a50b5b38265e541 Mon Sep 17 00:00:00 2001 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
2 |
From: Austin Clements <[email protected]> |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
3 |
Date: Sun, 15 Nov 2015 23:13:16 -0500 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
4 |
Subject: [PATCH 45/63] [release-branch.go1.5] runtime: handle sysReserve |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
5 |
returning a pointer below the arena |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
6 |
|
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
7 |
In mheap.sysAlloc, if an allocation at arena_used would exceed |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
8 |
arena_end (but wouldn't yet push us past arena_start+_MaxArean32), it |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
9 |
trie to extend the arena reservation by another 256 MB. It extends the |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
10 |
arena by calling sysReserve, which, on 32-bit, calls mmap without |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
11 |
MAP_FIXED, which means the address is just a hint and the kernel can |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
12 |
put the mapping wherever it wants. In particular, mmap may choose an |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
13 |
address below arena_start (the kernel also chose arena_start, so there |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
14 |
could be lots of space below it). Currently, we don't detect this case |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
15 |
and, if it happens, mheap.sysAlloc will corrupt arena_end and |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
16 |
arena_used then return the low pointer to mheap.grow, which will crash |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
17 |
when it attempts to index in to h_spans with an underflowed index. |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
18 |
|
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
19 |
Fix this by checking not only that that p+p_size isn't too high, but |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
20 |
that p isn't too low. |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
21 |
|
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
22 |
Fixes #13143. |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
23 |
|
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
24 |
Change-Id: I8d0f42bd1484460282a83c6f1a6f8f0df7fb2048 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
25 |
Reviewed-on: https://go-review.googlesource.com/16927 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
26 |
Run-TryBot: Austin Clements <[email protected]> |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
27 |
TryBot-Result: Gobot Gobot <[email protected]> |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
28 |
Reviewed-by: Ian Lance Taylor <[email protected]> |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
29 |
Reviewed-on: https://go-review.googlesource.com/16988 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
30 |
Reviewed-by: Russ Cox <[email protected]> |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
31 |
--- |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
32 |
src/runtime/malloc.go | 2 +- |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
33 |
1 file changed, 1 insertion(+), 1 deletion(-) |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
34 |
|
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
35 |
diff --git a/src/runtime/malloc.go b/src/runtime/malloc.go |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
36 |
index a8a5d48..b966eed 100644 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
37 |
--- a/src/runtime/malloc.go |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
38 |
+++ b/src/runtime/malloc.go |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
39 |
@@ -401,7 +401,7 @@ func mHeap_SysAlloc(h *mheap, n uintptr) unsafe.Pointer { |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
40 |
if p == h.arena_end { |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
41 |
h.arena_end = new_end |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
42 |
h.arena_reserved = reserved |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
43 |
- } else if p+p_size <= h.arena_start+_MaxArena32 { |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
44 |
+ } else if h.arena_start <= p && p+p_size <= h.arena_start+_MaxArena32 { |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
45 |
// Keep everything page-aligned. |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
46 |
// Our pages are bigger than hardware pages. |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
47 |
h.arena_end = p + p_size |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
48 |
-- |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
49 |
2.6.1 |
9c955076ffe3
PSARC/2015/203 Google Go version 1.5
Shawn Walker-Salas <shawn.walker@oracle.com>
parents:
diff
changeset
|
50 |