freebsd-skq/sys/vm/uma_dbg.c
markj cbe30ba7a3 Fix memguard(9) in kernels with INVARIANTS enabled.
With r284861, UMA zones use the trash ctor and dtor by default. This is
incompatible with memguard, which frees the backing page when the item
is freed. Modify the UMA debug functions to be no-ops if the item was
allocated from memguard. This also fixes constructors such as
mb_ctor_pack(), which invokes the trash ctor in addition to performing
some initialization.

Reviewed by:	glebius
MFC after:	3 weeks
Differential Revision:	https://reviews.freebsd.org/D6562
2016-06-01 22:31:35 +00:00

226 lines
4.9 KiB
C

/*-
* Copyright (c) 2002, 2003, 2004, 2005 Jeffrey Roberson <jeff@FreeBSD.org>
* Copyright (c) 2004, 2005 Bosko Milekic <bmilekic@FreeBSD.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice unmodified, this list of conditions, and the following
* disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/*
* uma_dbg.c Debugging features for UMA users
*
*/
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
#include "opt_vm.h"
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/bitset.h>
#include <sys/kernel.h>
#include <sys/types.h>
#include <sys/queue.h>
#include <sys/lock.h>
#include <sys/mutex.h>
#include <sys/malloc.h>
#include <vm/vm.h>
#include <vm/vm_object.h>
#include <vm/vm_page.h>
#include <vm/uma.h>
#include <vm/uma_int.h>
#include <vm/uma_dbg.h>
#include <vm/memguard.h>
static const uint32_t uma_junk = 0xdeadc0de;
/*
* Checks an item to make sure it hasn't been overwritten since it was freed,
* prior to subsequent reallocation.
*
* Complies with standard ctor arg/return
*/
int
trash_ctor(void *mem, int size, void *arg, int flags)
{
int cnt;
uint32_t *p;
#ifdef DEBUG_MEMGUARD
if (is_memguard_addr(mem))
return (0);
#endif
cnt = size / sizeof(uma_junk);
for (p = mem; cnt > 0; cnt--, p++)
if (*p != uma_junk) {
#ifdef INVARIANTS
panic("Memory modified after free %p(%d) val=%x @ %p\n",
mem, size, *p, p);
#else
printf("Memory modified after free %p(%d) val=%x @ %p\n",
mem, size, *p, p);
#endif
return (0);
}
return (0);
}
/*
* Fills an item with predictable garbage
*
* Complies with standard dtor arg/return
*
*/
void
trash_dtor(void *mem, int size, void *arg)
{
int cnt;
uint32_t *p;
#ifdef DEBUG_MEMGUARD
if (is_memguard_addr(mem))
return;
#endif
cnt = size / sizeof(uma_junk);
for (p = mem; cnt > 0; cnt--, p++)
*p = uma_junk;
}
/*
* Fills an item with predictable garbage
*
* Complies with standard init arg/return
*
*/
int
trash_init(void *mem, int size, int flags)
{
trash_dtor(mem, size, NULL);
return (0);
}
/*
* Checks an item to make sure it hasn't been overwritten since it was freed.
*
* Complies with standard fini arg/return
*
*/
void
trash_fini(void *mem, int size)
{
(void)trash_ctor(mem, size, NULL, 0);
}
int
mtrash_ctor(void *mem, int size, void *arg, int flags)
{
struct malloc_type **ksp;
uint32_t *p = mem;
int cnt;
#ifdef DEBUG_MEMGUARD
if (is_memguard_addr(mem))
return (0);
#endif
size -= sizeof(struct malloc_type *);
ksp = (struct malloc_type **)mem;
ksp += size / sizeof(struct malloc_type *);
cnt = size / sizeof(uma_junk);
for (p = mem; cnt > 0; cnt--, p++)
if (*p != uma_junk) {
printf("Memory modified after free %p(%d) val=%x @ %p\n",
mem, size, *p, p);
panic("Most recently used by %s\n", (*ksp == NULL)?
"none" : (*ksp)->ks_shortdesc);
}
return (0);
}
/*
* Fills an item with predictable garbage
*
* Complies with standard dtor arg/return
*
*/
void
mtrash_dtor(void *mem, int size, void *arg)
{
int cnt;
uint32_t *p;
#ifdef DEBUG_MEMGUARD
if (is_memguard_addr(mem))
return;
#endif
size -= sizeof(struct malloc_type *);
cnt = size / sizeof(uma_junk);
for (p = mem; cnt > 0; cnt--, p++)
*p = uma_junk;
}
/*
* Fills an item with predictable garbage
*
* Complies with standard init arg/return
*
*/
int
mtrash_init(void *mem, int size, int flags)
{
struct malloc_type **ksp;
#ifdef DEBUG_MEMGUARD
if (is_memguard_addr(mem))
return (0);
#endif
mtrash_dtor(mem, size, NULL);
ksp = (struct malloc_type **)mem;
ksp += (size / sizeof(struct malloc_type *)) - 1;
*ksp = NULL;
return (0);
}
/*
* Checks an item to make sure it hasn't been overwritten since it was freed,
* prior to freeing it back to available memory.
*
* Complies with standard fini arg/return
*
*/
void
mtrash_fini(void *mem, int size)
{
(void)mtrash_ctor(mem, size, NULL, 0);
}