|
|
25845f |
The upstream patch is backported by excluding tests for reallocarray because
|
|
|
25845f |
this function is not present in RHEL-7.
|
|
|
25845f |
|
|
|
25845f |
commit 8e448310d74b283c5cd02b9ed7fb997b47bf9b22
|
|
|
25845f |
Author: Arjun Shankar <arjun.is@lostca.se>
|
|
|
25845f |
Date: Thu Jan 18 16:47:06 2018 +0000
|
|
|
25845f |
|
|
|
25845f |
Fix integer overflows in internal memalign and malloc functions [BZ #22343]
|
|
|
25845f |
|
|
|
25845f |
When posix_memalign is called with an alignment less than MALLOC_ALIGNMENT
|
|
|
25845f |
and a requested size close to SIZE_MAX, it falls back to malloc code
|
|
|
25845f |
(because the alignment of a block returned by malloc is sufficient to
|
|
|
25845f |
satisfy the call). In this case, an integer overflow in _int_malloc leads
|
|
|
25845f |
to posix_memalign incorrectly returning successfully.
|
|
|
25845f |
|
|
|
25845f |
Upon fixing this and writing a somewhat thorough regression test, it was
|
|
|
25845f |
discovered that when posix_memalign is called with an alignment larger than
|
|
|
25845f |
MALLOC_ALIGNMENT (so it uses _int_memalign instead) and a requested size
|
|
|
25845f |
close to SIZE_MAX, a different integer overflow in _int_memalign leads to
|
|
|
25845f |
posix_memalign incorrectly returning successfully.
|
|
|
25845f |
|
|
|
25845f |
Both integer overflows affect other memory allocation functions that use
|
|
|
25845f |
_int_malloc (one affected malloc in x86) or _int_memalign as well.
|
|
|
25845f |
|
|
|
25845f |
This commit fixes both integer overflows. In addition to this, it adds a
|
|
|
25845f |
regression test to guard against false successful allocations by the
|
|
|
25845f |
following memory allocation functions when called with too-large allocation
|
|
|
25845f |
sizes and, where relevant, various valid alignments:
|
|
|
25845f |
malloc, realloc, calloc, reallocarray, memalign, posix_memalign,
|
|
|
25845f |
aligned_alloc, valloc, and pvalloc.
|
|
|
25845f |
|
|
|
25845f |
Index: b/malloc/Makefile
|
|
|
25845f |
===================================================================
|
|
|
25845f |
--- a/malloc/Makefile
|
|
|
25845f |
+++ b/malloc/Makefile
|
|
|
25845f |
@@ -38,6 +38,7 @@ tests := mallocbug tst-malloc tst-valloc
|
|
|
25845f |
tst-dynarray-fail \
|
|
|
25845f |
tst-dynarray-at-fail \
|
|
|
25845f |
tst-alloc_buffer \
|
|
|
25845f |
+ tst-malloc-too-large \
|
|
|
25845f |
|
|
|
25845f |
tests-static := \
|
|
|
25845f |
tst-interpose-static-nothread \
|
|
|
25845f |
Index: b/malloc/malloc.c
|
|
|
25845f |
===================================================================
|
|
|
25845f |
--- a/malloc/malloc.c
|
|
|
25845f |
+++ b/malloc/malloc.c
|
|
|
25845f |
@@ -1273,14 +1273,21 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-
|
|
|
25845f |
MINSIZE : \
|
|
|
25845f |
((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)
|
|
|
25845f |
|
|
|
25845f |
-/* Same, except also perform argument check */
|
|
|
25845f |
-
|
|
|
25845f |
-#define checked_request2size(req, sz) \
|
|
|
25845f |
- if (REQUEST_OUT_OF_RANGE(req)) { \
|
|
|
25845f |
- __set_errno (ENOMEM); \
|
|
|
25845f |
- return 0; \
|
|
|
25845f |
- } \
|
|
|
25845f |
- (sz) = request2size(req);
|
|
|
25845f |
+/* Same, except also perform an argument and result check. First, we check
|
|
|
25845f |
+ that the padding done by request2size didn't result in an integer
|
|
|
25845f |
+ overflow. Then we check (using REQUEST_OUT_OF_RANGE) that the resulting
|
|
|
25845f |
+ size isn't so large that a later alignment would lead to another integer
|
|
|
25845f |
+ overflow. */
|
|
|
25845f |
+#define checked_request2size(req, sz) \
|
|
|
25845f |
+({ \
|
|
|
25845f |
+ (sz) = request2size (req); \
|
|
|
25845f |
+ if (((sz) < (req)) \
|
|
|
25845f |
+ || REQUEST_OUT_OF_RANGE (sz)) \
|
|
|
25845f |
+ { \
|
|
|
25845f |
+ __set_errno (ENOMEM); \
|
|
|
25845f |
+ return 0; \
|
|
|
25845f |
+ } \
|
|
|
25845f |
+})
|
|
|
25845f |
|
|
|
25845f |
/*
|
|
|
25845f |
--------------- Physical chunk operations ---------------
|
|
|
25845f |
@@ -4389,6 +4396,13 @@ _int_memalign(mstate av, size_t alignmen
|
|
|
25845f |
*/
|
|
|
25845f |
|
|
|
25845f |
|
|
|
25845f |
+ /* Check for overflow. */
|
|
|
25845f |
+ if (nb > SIZE_MAX - alignment - MINSIZE)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ __set_errno (ENOMEM);
|
|
|
25845f |
+ return 0;
|
|
|
25845f |
+ }
|
|
|
25845f |
+
|
|
|
25845f |
/* Call malloc with worst case padding to hit alignment. */
|
|
|
25845f |
|
|
|
25845f |
m = (char*)(_int_malloc(av, nb + alignment + MINSIZE));
|
|
|
25845f |
Index: b/malloc/tst-malloc-too-large.c
|
|
|
25845f |
===================================================================
|
|
|
25845f |
--- /dev/null
|
|
|
25845f |
+++ b/malloc/tst-malloc-too-large.c
|
|
|
25845f |
@@ -0,0 +1,237 @@
|
|
|
25845f |
+/* Test and verify that too-large memory allocations fail with ENOMEM.
|
|
|
25845f |
+ Copyright (C) 2018 Free Software Foundation, Inc.
|
|
|
25845f |
+ This file is part of the GNU C Library.
|
|
|
25845f |
+
|
|
|
25845f |
+ The GNU C Library is free software; you can redistribute it and/or
|
|
|
25845f |
+ modify it under the terms of the GNU Lesser General Public
|
|
|
25845f |
+ License as published by the Free Software Foundation; either
|
|
|
25845f |
+ version 2.1 of the License, or (at your option) any later version.
|
|
|
25845f |
+
|
|
|
25845f |
+ The GNU C Library is distributed in the hope that it will be useful,
|
|
|
25845f |
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
25845f |
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
25845f |
+ Lesser General Public License for more details.
|
|
|
25845f |
+
|
|
|
25845f |
+ You should have received a copy of the GNU Lesser General Public
|
|
|
25845f |
+ License along with the GNU C Library; if not, see
|
|
|
25845f |
+ <http://www.gnu.org/licenses/>. */
|
|
|
25845f |
+
|
|
|
25845f |
+/* Bug 22375 reported a regression in malloc where if after malloc'ing then
|
|
|
25845f |
+ free'ing a small block of memory, malloc is then called with a really
|
|
|
25845f |
+ large size argument (close to SIZE_MAX): instead of returning NULL and
|
|
|
25845f |
+ setting errno to ENOMEM, malloc incorrectly returns the previously
|
|
|
25845f |
+ allocated block instead. Bug 22343 reported a similar case where
|
|
|
25845f |
+ posix_memalign incorrectly returns successfully when called with an with
|
|
|
25845f |
+ a really large size argument.
|
|
|
25845f |
+
|
|
|
25845f |
+ Both of these were caused by integer overflows in the allocator when it
|
|
|
25845f |
+ was trying to pad the requested size to allow for book-keeping or
|
|
|
25845f |
+ alignment. This test guards against such bugs by repeatedly allocating
|
|
|
25845f |
+ and freeing small blocks of memory then trying to allocate various block
|
|
|
25845f |
+ sizes larger than the memory bus width of 64-bit targets, or almost
|
|
|
25845f |
+ as large as SIZE_MAX on 32-bit targets supported by glibc. In each case,
|
|
|
25845f |
+ it verifies that such impossibly large allocations correctly fail. */
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+#include <stdlib.h>
|
|
|
25845f |
+#include <malloc.h>
|
|
|
25845f |
+#include <errno.h>
|
|
|
25845f |
+#include <stdint.h>
|
|
|
25845f |
+#include <sys/resource.h>
|
|
|
25845f |
+#include <libc-diag.h>
|
|
|
25845f |
+#include <support/check.h>
|
|
|
25845f |
+#include <unistd.h>
|
|
|
25845f |
+#include <sys/param.h>
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+/* This function prepares for each 'too-large memory allocation' test by
|
|
|
25845f |
+ performing a small successful malloc/free and resetting errno prior to
|
|
|
25845f |
+ the actual test. */
|
|
|
25845f |
+static void
|
|
|
25845f |
+test_setup (void)
|
|
|
25845f |
+{
|
|
|
25845f |
+ void *volatile ptr = malloc (16);
|
|
|
25845f |
+ TEST_VERIFY_EXIT (ptr != NULL);
|
|
|
25845f |
+ free (ptr);
|
|
|
25845f |
+ errno = 0;
|
|
|
25845f |
+}
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+/* This function tests each of:
|
|
|
25845f |
+ - malloc (SIZE)
|
|
|
25845f |
+ - realloc (PTR_FOR_REALLOC, SIZE)
|
|
|
25845f |
+ - for various values of NMEMB:
|
|
|
25845f |
+ - calloc (NMEMB, SIZE/NMEMB)
|
|
|
25845f |
+ - calloc (SIZE/NMEMB, NMEMB)
|
|
|
25845f |
+ and precedes each of these tests with a small malloc/free before it. */
|
|
|
25845f |
+static void
|
|
|
25845f |
+test_large_allocations (size_t size)
|
|
|
25845f |
+{
|
|
|
25845f |
+ void * ptr_to_realloc;
|
|
|
25845f |
+
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (malloc (size) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+
|
|
|
25845f |
+ ptr_to_realloc = malloc (16);
|
|
|
25845f |
+ TEST_VERIFY_EXIT (ptr_to_realloc != NULL);
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (realloc (ptr_to_realloc, size) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+ free (ptr_to_realloc);
|
|
|
25845f |
+
|
|
|
25845f |
+ for (size_t nmemb = 1; nmemb <= 8; nmemb *= 2)
|
|
|
25845f |
+ if ((size % nmemb) == 0)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (calloc (nmemb, size / nmemb) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (calloc (size / nmemb, nmemb) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+ }
|
|
|
25845f |
+ else
|
|
|
25845f |
+ break;
|
|
|
25845f |
+}
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+static long pagesize;
|
|
|
25845f |
+
|
|
|
25845f |
+/* This function tests the following aligned memory allocation functions
|
|
|
25845f |
+ using several valid alignments and precedes each allocation test with a
|
|
|
25845f |
+ small malloc/free before it:
|
|
|
25845f |
+ memalign, posix_memalign, aligned_alloc, valloc, pvalloc. */
|
|
|
25845f |
+static void
|
|
|
25845f |
+test_large_aligned_allocations (size_t size)
|
|
|
25845f |
+{
|
|
|
25845f |
+ /* ptr stores the result of posix_memalign but since all those calls
|
|
|
25845f |
+ should fail, posix_memalign should never change ptr. We set it to
|
|
|
25845f |
+ NULL here and later on we check that it remains NULL after each
|
|
|
25845f |
+ posix_memalign call. */
|
|
|
25845f |
+ void * ptr = NULL;
|
|
|
25845f |
+
|
|
|
25845f |
+ size_t align;
|
|
|
25845f |
+
|
|
|
25845f |
+ /* All aligned memory allocation functions expect an alignment that is a
|
|
|
25845f |
+ power of 2. Given this, we test each of them with every valid
|
|
|
25845f |
+ alignment from 1 thru PAGESIZE. */
|
|
|
25845f |
+ for (align = 1; align <= pagesize; align *= 2)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (memalign (align, size) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+
|
|
|
25845f |
+ /* posix_memalign expects an alignment that is a power of 2 *and* a
|
|
|
25845f |
+ multiple of sizeof (void *). */
|
|
|
25845f |
+ if ((align % sizeof (void *)) == 0)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (posix_memalign (&ptr, align, size) == ENOMEM);
|
|
|
25845f |
+ TEST_VERIFY (ptr == NULL);
|
|
|
25845f |
+ }
|
|
|
25845f |
+
|
|
|
25845f |
+ /* aligned_alloc expects a size that is a multiple of alignment. */
|
|
|
25845f |
+ if ((size % align) == 0)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (aligned_alloc (align, size) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+ }
|
|
|
25845f |
+ }
|
|
|
25845f |
+
|
|
|
25845f |
+ /* Both valloc and pvalloc return page-aligned memory. */
|
|
|
25845f |
+
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (valloc (size) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+
|
|
|
25845f |
+ test_setup ();
|
|
|
25845f |
+ TEST_VERIFY (pvalloc (size) == NULL);
|
|
|
25845f |
+ TEST_VERIFY (errno == ENOMEM);
|
|
|
25845f |
+}
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+#define FOURTEEN_ON_BITS ((1UL << 14) - 1)
|
|
|
25845f |
+#define FIFTY_ON_BITS ((1UL << 50) - 1)
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+static int
|
|
|
25845f |
+do_test (void)
|
|
|
25845f |
+{
|
|
|
25845f |
+
|
|
|
25845f |
+#if __WORDSIZE >= 64
|
|
|
25845f |
+
|
|
|
25845f |
+ /* This test assumes that none of the supported targets have an address
|
|
|
25845f |
+ bus wider than 50 bits, and that therefore allocations for sizes wider
|
|
|
25845f |
+ than 50 bits will fail. Here, we ensure that the assumption continues
|
|
|
25845f |
+ to be true in the future when we might have address buses wider than 50
|
|
|
25845f |
+ bits. */
|
|
|
25845f |
+
|
|
|
25845f |
+ struct rlimit alloc_size_limit
|
|
|
25845f |
+ = {
|
|
|
25845f |
+ .rlim_cur = FIFTY_ON_BITS,
|
|
|
25845f |
+ .rlim_max = FIFTY_ON_BITS
|
|
|
25845f |
+ };
|
|
|
25845f |
+
|
|
|
25845f |
+ setrlimit (RLIMIT_AS, &alloc_size_limit);
|
|
|
25845f |
+
|
|
|
25845f |
+#endif /* __WORDSIZE >= 64 */
|
|
|
25845f |
+
|
|
|
25845f |
+ DIAG_PUSH_NEEDS_COMMENT;
|
|
|
25845f |
+#if __GNUC_PREREQ (7, 0)
|
|
|
25845f |
+ /* GCC 7 warns about too-large allocations; here we want to test
|
|
|
25845f |
+ that they fail. */
|
|
|
25845f |
+ DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than=");
|
|
|
25845f |
+#endif
|
|
|
25845f |
+
|
|
|
25845f |
+ /* Aligned memory allocation functions need to be tested up to alignment
|
|
|
25845f |
+ size equivalent to page size, which should be a power of 2. */
|
|
|
25845f |
+ pagesize = sysconf (_SC_PAGESIZE);
|
|
|
25845f |
+ TEST_VERIFY_EXIT (powerof2 (pagesize));
|
|
|
25845f |
+
|
|
|
25845f |
+ /* Loop 1: Ensure that all allocations with SIZE close to SIZE_MAX, i.e.
|
|
|
25845f |
+ in the range (SIZE_MAX - 2^14, SIZE_MAX], fail.
|
|
|
25845f |
+
|
|
|
25845f |
+ We can expect that this range of allocation sizes will always lead to
|
|
|
25845f |
+ an allocation failure on both 64 and 32 bit targets, because:
|
|
|
25845f |
+
|
|
|
25845f |
+ 1. no currently supported 64-bit target has an address bus wider than
|
|
|
25845f |
+ 50 bits -- and (2^64 - 2^14) is much wider than that;
|
|
|
25845f |
+
|
|
|
25845f |
+ 2. on 32-bit targets, even though 2^32 is only 4 GB and potentially
|
|
|
25845f |
+ addressable, glibc itself is more than 2^14 bytes in size, and
|
|
|
25845f |
+ therefore once glibc is loaded, less than (2^32 - 2^14) bytes remain
|
|
|
25845f |
+ available. */
|
|
|
25845f |
+
|
|
|
25845f |
+ for (size_t i = 0; i <= FOURTEEN_ON_BITS; i++)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ test_large_allocations (SIZE_MAX - i);
|
|
|
25845f |
+ test_large_aligned_allocations (SIZE_MAX - i);
|
|
|
25845f |
+ }
|
|
|
25845f |
+
|
|
|
25845f |
+#if __WORDSIZE >= 64
|
|
|
25845f |
+ /* On 64-bit targets, we need to test a much wider range of too-large
|
|
|
25845f |
+ sizes, so we test at intervals of (1 << 50) that allocation sizes
|
|
|
25845f |
+ ranging from SIZE_MAX down to (1 << 50) fail:
|
|
|
25845f |
+ The 14 MSBs are decremented starting from "all ON" going down to 1,
|
|
|
25845f |
+ the 50 LSBs are "all ON" and then "all OFF" during every iteration. */
|
|
|
25845f |
+ for (size_t msbs = FOURTEEN_ON_BITS; msbs >= 1; msbs--)
|
|
|
25845f |
+ {
|
|
|
25845f |
+ size_t size = (msbs << 50) | FIFTY_ON_BITS;
|
|
|
25845f |
+ test_large_allocations (size);
|
|
|
25845f |
+ test_large_aligned_allocations (size);
|
|
|
25845f |
+
|
|
|
25845f |
+ size = msbs << 50;
|
|
|
25845f |
+ test_large_allocations (size);
|
|
|
25845f |
+ test_large_aligned_allocations (size);
|
|
|
25845f |
+ }
|
|
|
25845f |
+#endif /* __WORDSIZE >= 64 */
|
|
|
25845f |
+
|
|
|
25845f |
+ DIAG_POP_NEEDS_COMMENT;
|
|
|
25845f |
+
|
|
|
25845f |
+ return 0;
|
|
|
25845f |
+}
|
|
|
25845f |
+
|
|
|
25845f |
+
|
|
|
25845f |
+#include <support/test-driver.c>
|