077c9d
commit bcdaad21d4635931d1bd3b54a7894276925d081d
077c9d
Author: DJ Delorie <dj@delorie.com>
077c9d
Date:   Tue Nov 20 13:24:09 2018 -0500
077c9d
077c9d
    malloc: tcache double free check
077c9d
    
077c9d
    * malloc/malloc.c (tcache_entry): Add key field.
077c9d
    (tcache_put): Set it.
077c9d
    (tcache_get): Likewise.
077c9d
    (_int_free): Check for double free in tcache.
077c9d
    * malloc/tst-tcfree1.c: New.
077c9d
    * malloc/tst-tcfree2.c: New.
077c9d
    * malloc/Makefile: Run the new tests.
077c9d
    * manual/probes.texi: Document memory_tcache_double_free probe.
077c9d
    
077c9d
    * dlfcn/dlerror.c (check_free): Prevent double frees.
077c9d
077c9d
diff --git a/dlfcn/dlerror.c b/dlfcn/dlerror.c
077c9d
index 33574faab65628ff..96bf92533335036b 100644
077c9d
--- a/dlfcn/dlerror.c
077c9d
+++ b/dlfcn/dlerror.c
077c9d
@@ -198,7 +198,10 @@ check_free (struct dl_action_result *rec)
077c9d
       Dl_info info;
077c9d
       if (_dl_addr (check_free, &info, &map, NULL) != 0 && map->l_ns == 0)
077c9d
 #endif
077c9d
-	free ((char *) rec->errstring);
077c9d
+	{
077c9d
+	  free ((char *) rec->errstring);
077c9d
+	  rec->errstring = NULL;
077c9d
+	}
077c9d
     }
077c9d
 }
077c9d
 
077c9d
diff --git a/malloc/Makefile b/malloc/Makefile
077c9d
index 7d54bad866f63cb8..e6dfbfc14cb3d140 100644
077c9d
--- a/malloc/Makefile
077c9d
+++ b/malloc/Makefile
077c9d
@@ -38,6 +38,7 @@ tests := mallocbug tst-malloc tst-valloc tst-calloc tst-obstack \
077c9d
 	 tst-malloc_info \
077c9d
 	 tst-malloc-too-large \
077c9d
 	 tst-malloc-stats-cancellation \
077c9d
+	 tst-tcfree1 tst-tcfree2 \
077c9d
 
077c9d
 tests-static := \
077c9d
 	 tst-interpose-static-nothread \
077c9d
diff --git a/malloc/malloc.c b/malloc/malloc.c
077c9d
index e247c77b7d4de26e..c6b0282e783eaeea 100644
077c9d
--- a/malloc/malloc.c
077c9d
+++ b/malloc/malloc.c
077c9d
@@ -2888,6 +2888,8 @@ mremap_chunk (mchunkptr p, size_t new_size)
077c9d
 typedef struct tcache_entry
077c9d
 {
077c9d
   struct tcache_entry *next;
077c9d
+  /* This field exists to detect double frees.  */
077c9d
+  struct tcache_perthread_struct *key;
077c9d
 } tcache_entry;
077c9d
 
077c9d
 /* There is one of these for each thread, which contains the
077c9d
@@ -2911,6 +2913,11 @@ tcache_put (mchunkptr chunk, size_t tc_idx)
077c9d
 {
077c9d
   tcache_entry *e = (tcache_entry *) chunk2mem (chunk);
077c9d
   assert (tc_idx < TCACHE_MAX_BINS);
077c9d
+
077c9d
+  /* Mark this chunk as "in the tcache" so the test in _int_free will
077c9d
+     detect a double free.  */
077c9d
+  e->key = tcache;
077c9d
+
077c9d
   e->next = tcache->entries[tc_idx];
077c9d
   tcache->entries[tc_idx] = e;
077c9d
   ++(tcache->counts[tc_idx]);
077c9d
@@ -2926,6 +2933,7 @@ tcache_get (size_t tc_idx)
077c9d
   assert (tcache->entries[tc_idx] > 0);
077c9d
   tcache->entries[tc_idx] = e->next;
077c9d
   --(tcache->counts[tc_idx]);
077c9d
+  e->key = NULL;
077c9d
   return (void *) e;
077c9d
 }
077c9d
 
077c9d
@@ -4152,6 +4160,26 @@ _int_free (mstate av, mchunkptr p, int have_lock)
077c9d
   {
077c9d
     size_t tc_idx = csize2tidx (size);
077c9d
 
077c9d
+    /* Check to see if it's already in the tcache.  */
077c9d
+    tcache_entry *e = (tcache_entry *) chunk2mem (p);
077c9d
+
077c9d
+    /* This test succeeds on double free.  However, we don't 100%
077c9d
+       trust it (it also matches random payload data at a 1 in
077c9d
+       2^<size_t> chance), so verify it's not an unlikely coincidence
077c9d
+       before aborting.  */
077c9d
+    if (__glibc_unlikely (e->key == tcache && tcache))
077c9d
+      {
077c9d
+	tcache_entry *tmp;
077c9d
+	LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
077c9d
+	for (tmp = tcache->entries[tc_idx];
077c9d
+	     tmp;
077c9d
+	     tmp = tmp->next)
077c9d
+	  if (tmp == e)
077c9d
+	    malloc_printerr ("free(): double free detected in tcache 2");
077c9d
+	/* If we get here, it was a coincidence.  We've wasted a few
077c9d
+	   cycles, but don't abort.  */
077c9d
+      }
077c9d
+
077c9d
     if (tcache
077c9d
 	&& tc_idx < mp_.tcache_bins
077c9d
 	&& tcache->counts[tc_idx] < mp_.tcache_count)
077c9d
diff --git a/malloc/tst-tcfree1.c b/malloc/tst-tcfree1.c
077c9d
new file mode 100644
077c9d
index 0000000000000000..bc29375ce77304ac
077c9d
--- /dev/null
077c9d
+++ b/malloc/tst-tcfree1.c
077c9d
@@ -0,0 +1,42 @@
077c9d
+/* Test that malloc tcache catches double free.
077c9d
+   Copyright (C) 2018 Free Software Foundation, Inc.
077c9d
+   This file is part of the GNU C Library.
077c9d
+
077c9d
+   The GNU C Library is free software; you can redistribute it and/or
077c9d
+   modify it under the terms of the GNU Lesser General Public
077c9d
+   License as published by the Free Software Foundation; either
077c9d
+   version 2.1 of the License, or (at your option) any later version.
077c9d
+
077c9d
+   The GNU C Library is distributed in the hope that it will be useful,
077c9d
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
077c9d
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
077c9d
+   Lesser General Public License for more details.
077c9d
+
077c9d
+   You should have received a copy of the GNU Lesser General Public
077c9d
+   License along with the GNU C Library; if not, see
077c9d
+   <http://www.gnu.org/licenses/>.  */
077c9d
+
077c9d
+#include <errno.h>
077c9d
+#include <error.h>
077c9d
+#include <limits.h>
077c9d
+#include <malloc.h>
077c9d
+#include <stdlib.h>
077c9d
+#include <stdio.h>
077c9d
+#include <sys/signal.h>
077c9d
+
077c9d
+static int
077c9d
+do_test (void)
077c9d
+{
077c9d
+  /* Do one allocation of any size that fits in tcache.  */
077c9d
+  char * volatile x = malloc (32);
077c9d
+
077c9d
+  free (x); // puts in tcache
077c9d
+  free (x); // should abort
077c9d
+
077c9d
+  printf("FAIL: tcache double free not detected\n");
077c9d
+  return 1;
077c9d
+}
077c9d
+
077c9d
+#define TEST_FUNCTION do_test
077c9d
+#define EXPECTED_SIGNAL SIGABRT
077c9d
+#include <support/test-driver.c>
077c9d
diff --git a/malloc/tst-tcfree2.c b/malloc/tst-tcfree2.c
077c9d
new file mode 100644
077c9d
index 0000000000000000..17f06bacd411c315
077c9d
--- /dev/null
077c9d
+++ b/malloc/tst-tcfree2.c
077c9d
@@ -0,0 +1,48 @@
077c9d
+/* Test that malloc tcache catches double free.
077c9d
+   Copyright (C) 2018 Free Software Foundation, Inc.
077c9d
+   This file is part of the GNU C Library.
077c9d
+
077c9d
+   The GNU C Library is free software; you can redistribute it and/or
077c9d
+   modify it under the terms of the GNU Lesser General Public
077c9d
+   License as published by the Free Software Foundation; either
077c9d
+   version 2.1 of the License, or (at your option) any later version.
077c9d
+
077c9d
+   The GNU C Library is distributed in the hope that it will be useful,
077c9d
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
077c9d
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
077c9d
+   Lesser General Public License for more details.
077c9d
+
077c9d
+   You should have received a copy of the GNU Lesser General Public
077c9d
+   License along with the GNU C Library; if not, see
077c9d
+   <http://www.gnu.org/licenses/>.  */
077c9d
+
077c9d
+#include <errno.h>
077c9d
+#include <error.h>
077c9d
+#include <limits.h>
077c9d
+#include <malloc.h>
077c9d
+#include <stdlib.h>
077c9d
+#include <stdio.h>
077c9d
+#include <sys/signal.h>
077c9d
+
077c9d
+static int
077c9d
+do_test (void)
077c9d
+{
077c9d
+  char * volatile ptrs[20];
077c9d
+  int i;
077c9d
+
077c9d
+  /* Allocate enough small chunks so that when we free them all, the tcache
077c9d
+     is full, and the first one we freed is at the end of its linked list.  */
077c9d
+#define COUNT 20
077c9d
+  for (i=0; i
077c9d
+    ptrs[i] = malloc (20);
077c9d
+  for (i=0; i
077c9d
+    free (ptrs[i]);
077c9d
+  free (ptrs[0]);
077c9d
+
077c9d
+  printf("FAIL: tcache double free\n");
077c9d
+  return 1;
077c9d
+}
077c9d
+
077c9d
+#define TEST_FUNCTION do_test
077c9d
+#define EXPECTED_SIGNAL SIGABRT
077c9d
+#include <support/test-driver.c>
077c9d
diff --git a/manual/probes.texi b/manual/probes.texi
077c9d
index ab2a3102bb350ef4..0ea560ed78bcfd7e 100644
077c9d
--- a/manual/probes.texi
077c9d
+++ b/manual/probes.texi
077c9d
@@ -243,6 +243,18 @@ This probe is triggered when the
077c9d
 value of this tunable.
077c9d
 @end deftp
077c9d
 
077c9d
+@deftp Probe memory_tcache_double_free (void *@var{$arg1}, int @var{$arg2})
077c9d
+This probe is triggered when @code{free} determines that the memory
077c9d
+being freed has probably already been freed, and resides in the
077c9d
+per-thread cache.  Note that there is an extremely unlikely chance
077c9d
+that this probe will trigger due to random payload data remaining in
077c9d
+the allocated memory matching the key used to detect double frees.
077c9d
+This probe actually indicates that an expensive linear search of the
077c9d
+tcache, looking for a double free, has happened.  Argument @var{$arg1}
077c9d
+is the memory location as passed to @code{free}, Argument @var{$arg2}
077c9d
+is the tcache bin it resides in.
077c9d
+@end deftp
077c9d
+
077c9d
 @node Mathematical Function Probes
077c9d
 @section Mathematical Function Probes
077c9d