From 23b4230f6af3d548e33e486eb0e3e74523cee5fd Mon Sep 17 00:00:00 2001 From: Matthew Parkinson Date: Thu, 14 Nov 2019 12:50:53 +0000 Subject: [PATCH] Fixed leak in free list. If the first call to alloc uses the minimum size class, then we end up leaking a whole page of allocations. We fill the small_fast_free_list, in a call to build the message_queue. But this means the small_fast_free_list[0] is not empty. But the code was staying on the slow path, and overwriting it. --- src/mem/alloc.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/mem/alloc.h b/src/mem/alloc.h index 09ebf96..4ed76a6 100644 --- a/src/mem/alloc.h +++ b/src/mem/alloc.h @@ -1084,7 +1084,12 @@ namespace snmalloc SNMALLOC_ASSUME(size <= SLAB_SIZE); sizeclass_t sizeclass = size_to_sizeclass(size); + return small_alloc_inner(sizeclass); + } + template + SNMALLOC_FAST_PATH void* small_alloc_inner(sizeclass_t sizeclass) + { assert(sizeclass < NUM_SMALL_CLASSES); auto& fl = small_fast_free_lists[sizeclass]; void* head = fl.value; @@ -1097,7 +1102,7 @@ namespace snmalloc void* p = remove_cache_friendly_offset(head, sizeclass); if constexpr (zero_mem == YesZero) { - large_allocator.memory_provider.zero(p, size); + large_allocator.memory_provider.zero(p, sizeclass_to_size(sizeclass)); } return p; }