d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In realloc(9), determine size of the original block based on

Browse Source 
UMA_SLAB_MALLOC flag.
In some circumstances (I observed it when I was doing a lot of reallocs)
UMA_SLAB_MALLOC can be set even if us_keg != NULL.

If this is the case we have wonderful, silent data corruption, because less
data is copied to the newly allocated region than should be.

I'm not sure when this bug was introduced, it could be there undetected
for years now, as we don't have a lot of realloc(9) consumers and it was
hard to reproduce it...
...but what I know for sure, is that I don't want to know who introduce
the bug:) It took me two/three days to track it down (of course most of
the time I was looking for the bug in my own code).
This commit is contained in:
Pawel Jakub Dawidek 2005-12-28 01:53:13 +00:00
parent 333051eeb3
commit 619f284195
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/kern/kern_malloc.c
View File

@ -437,7 +437,7 @@ if (mtp == M_SUBPROC) {
("realloc: address %p out of range", (void *)addr));
/* Get the size of the original block */
if (slab->us_keg)
if (!(slab->us_flags & UMA_SLAB_MALLOC))
alloc = slab->us_keg->uk_size;
else
alloc = slab->us_size;