From ebe84899105cfa71b39eeb85a3d88da9818e4f82 Mon Sep 17 00:00:00 2001 From: Nathaniel Filardo Date: Sat, 3 Apr 2021 18:08:39 +0100 Subject: [PATCH] Size-known large dealloc paths should also round up Like we already do in the size-unknown case. This ensures that in the CHERI case we'll always bound to the size of the segment we return to the large alloc, not to a subset. It has the added bonus of ensuring that our bounds are precisely representable. --- src/mem/alloc.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/mem/alloc.h b/src/mem/alloc.h index 91d1de1..8422ad4 100644 --- a/src/mem/alloc.h +++ b/src/mem/alloc.h @@ -1438,11 +1438,17 @@ namespace snmalloc uint8_t claimed_chunkmap_slab_kind = static_cast(bits::next_pow2_bits(size)); + // This also catches some "not deallocating start of an object" cases: if + // we're so far from the start that our actual chunkmap slab kind is not a + // legitimate large class check_client( chunkmap().get(address_cast(p)) == claimed_chunkmap_slab_kind, "Claimed large deallocation with wrong size class"); - large_dealloc_checked_sizeclass(p, size, claimed_chunkmap_slab_kind); + // round up as we would if we had had to look up the chunkmap_slab_kind + size_t rsize = bits::one_at_bit(claimed_chunkmap_slab_kind); + + large_dealloc_checked_sizeclass(p, rsize, claimed_chunkmap_slab_kind); } void large_dealloc_checked_sizeclass(