From bcdaad21d4635931d1bd3b54a7894276925d081d Mon Sep 17 00:00:00 2001 From: DJ Delorie Date: Tue, 20 Nov 2018 13:24:09 -0500 Subject: malloc: tcache double free check * malloc/malloc.c (tcache_entry): Add key field. (tcache_put): Set it. (tcache_get): Likewise. (_int_free): Check for double free in tcache. * malloc/tst-tcfree1.c: New. * malloc/tst-tcfree2.c: New. * malloc/Makefile: Run the new tests. * manual/probes.texi: Document memory_tcache_double_free probe. * dlfcn/dlerror.c (check_free): Prevent double frees. --- manual/probes.texi | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'manual') diff --git a/manual/probes.texi b/manual/probes.texi index ab2a310..0ea560e 100644 --- a/manual/probes.texi +++ b/manual/probes.texi @@ -243,6 +243,18 @@ This probe is triggered when the value of this tunable. @end deftp +@deftp Probe memory_tcache_double_free (void *@var{$arg1}, int @var{$arg2}) +This probe is triggered when @code{free} determines that the memory +being freed has probably already been freed, and resides in the +per-thread cache. Note that there is an extremely unlikely chance +that this probe will trigger due to random payload data remaining in +the allocated memory matching the key used to detect double frees. +This probe actually indicates that an expensive linear search of the +tcache, looking for a double free, has happened. Argument @var{$arg1} +is the memory location as passed to @code{free}, Argument @var{$arg2} +is the tcache bin it resides in. +@end deftp + @node Mathematical Function Probes @section Mathematical Function Probes -- cgit v1.1