Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 1 | /* |
Willy Tarreau | 62405a2 | 2014-12-23 13:51:28 +0100 | [diff] [blame] | 2 | * include/common/memory.h |
| 3 | * Memory management definitions.. |
| 4 | * |
| 5 | * Copyright (C) 2000-2014 Willy Tarreau - w@1wt.eu |
| 6 | * |
| 7 | * This library is free software; you can redistribute it and/or |
| 8 | * modify it under the terms of the GNU Lesser General Public |
| 9 | * License as published by the Free Software Foundation, version 2.1 |
| 10 | * exclusively. |
| 11 | * |
| 12 | * This library is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 15 | * Lesser General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU Lesser General Public |
| 18 | * License along with this library; if not, write to the Free Software |
| 19 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
| 20 | */ |
Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 21 | |
Willy Tarreau | 2dd0d47 | 2006-06-29 17:53:05 +0200 | [diff] [blame] | 22 | #ifndef _COMMON_MEMORY_H |
| 23 | #define _COMMON_MEMORY_H |
Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 24 | |
Willy Tarreau | 158fa75 | 2017-11-22 15:47:29 +0100 | [diff] [blame] | 25 | #include <sys/mman.h> |
| 26 | |
Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 27 | #include <stdlib.h> |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 28 | #include <string.h> |
Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 29 | |
Willy Tarreau | 2dd0d47 | 2006-06-29 17:53:05 +0200 | [diff] [blame] | 30 | #include <common/config.h> |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 31 | #include <common/mini-clist.h> |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 32 | #include <common/hathreads.h> |
Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 33 | |
Willy Tarreau | a84dcb8 | 2015-10-28 12:04:02 +0100 | [diff] [blame] | 34 | #ifndef DEBUG_DONT_SHARE_POOLS |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 35 | #define MEM_F_SHARED 0x1 |
Willy Tarreau | a84dcb8 | 2015-10-28 12:04:02 +0100 | [diff] [blame] | 36 | #else |
| 37 | #define MEM_F_SHARED 0 |
| 38 | #endif |
Willy Tarreau | 581bf81 | 2016-01-25 02:19:13 +0100 | [diff] [blame] | 39 | #define MEM_F_EXACT 0x2 |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 40 | |
Willy Tarreau | ac42111 | 2015-10-28 15:09:29 +0100 | [diff] [blame] | 41 | /* reserve an extra void* at the end of a pool for linking */ |
| 42 | #ifdef DEBUG_MEMORY_POOLS |
| 43 | #define POOL_EXTRA (sizeof(void *)) |
| 44 | #define POOL_LINK(pool, item) (void **)(((char *)item) + (pool->size)) |
| 45 | #else |
| 46 | #define POOL_EXTRA (0) |
| 47 | #define POOL_LINK(pool, item) ((void **)(item)) |
| 48 | #endif |
| 49 | |
Olivier Houchard | cf975d4 | 2018-01-24 18:38:31 +0100 | [diff] [blame] | 50 | #ifdef HA_HAVE_CAS_DW |
| 51 | struct pool_free_list { |
| 52 | void **free_list; |
| 53 | uintptr_t seq; |
| 54 | }; |
| 55 | #endif |
| 56 | |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 57 | struct pool_head { |
Willy Tarreau | 1ca1b70 | 2017-11-26 10:50:36 +0100 | [diff] [blame] | 58 | void **free_list; |
Olivier Houchard | cf975d4 | 2018-01-24 18:38:31 +0100 | [diff] [blame] | 59 | #ifdef HA_HAVE_CAS_DW |
| 60 | uintptr_t seq; |
| 61 | #else |
| 62 | __decl_hathreads(HA_SPINLOCK_T lock); /* the spin lock */ |
| 63 | #endif |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 64 | unsigned int used; /* how many chunks are currently in use */ |
| 65 | unsigned int allocated; /* how many chunks have been allocated */ |
| 66 | unsigned int limit; /* hard limit on the number of chunks */ |
| 67 | unsigned int minavail; /* how many chunks are expected to be used */ |
| 68 | unsigned int size; /* chunk size */ |
| 69 | unsigned int flags; /* MEM_F_* */ |
Willy Tarreau | 7dcd46d | 2007-05-14 00:16:13 +0200 | [diff] [blame] | 70 | unsigned int users; /* number of pools sharing this zone */ |
Willy Tarreau | 58102cf | 2015-10-28 16:24:21 +0100 | [diff] [blame] | 71 | unsigned int failed; /* failed allocations */ |
Olivier Houchard | cf975d4 | 2018-01-24 18:38:31 +0100 | [diff] [blame] | 72 | struct list list; /* list of all known pools */ |
Willy Tarreau | 7dcd46d | 2007-05-14 00:16:13 +0200 | [diff] [blame] | 73 | char name[12]; /* name of the pool */ |
Willy Tarreau | 1ca1b70 | 2017-11-26 10:50:36 +0100 | [diff] [blame] | 74 | } __attribute__((aligned(64))); |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 75 | |
Willy Tarreau | 067ac9f | 2015-10-08 14:12:13 +0200 | [diff] [blame] | 76 | /* poison each newly allocated area with this byte if >= 0 */ |
| 77 | extern int mem_poison_byte; |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 78 | |
Willy Tarreau | a885f6d | 2014-12-03 15:25:28 +0100 | [diff] [blame] | 79 | /* Allocates new entries for pool <pool> until there are at least <avail> + 1 |
| 80 | * available, then returns the last one for immediate use, so that at least |
| 81 | * <avail> are left available in the pool upon return. NULL is returned if the |
| 82 | * last entry could not be allocated. It's important to note that at least one |
| 83 | * allocation is always performed even if there are enough entries in the pool. |
| 84 | * A call to the garbage collector is performed at most once in case malloc() |
| 85 | * returns an error, before returning NULL. |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 86 | */ |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 87 | void *__pool_refill_alloc(struct pool_head *pool, unsigned int avail); |
Willy Tarreau | a885f6d | 2014-12-03 15:25:28 +0100 | [diff] [blame] | 88 | void *pool_refill_alloc(struct pool_head *pool, unsigned int avail); |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 89 | |
| 90 | /* Try to find an existing shared pool with the same characteristics and |
| 91 | * returns it, otherwise creates this one. NULL is returned if no memory |
| 92 | * is available for a new creation. |
| 93 | */ |
| 94 | struct pool_head *create_pool(char *name, unsigned int size, unsigned int flags); |
| 95 | |
| 96 | /* Dump statistics on pools usage. |
| 97 | */ |
Willy Tarreau | 12833bb | 2014-01-28 16:49:56 +0100 | [diff] [blame] | 98 | void dump_pools_to_trash(); |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 99 | void dump_pools(void); |
Willy Tarreau | 58102cf | 2015-10-28 16:24:21 +0100 | [diff] [blame] | 100 | int pool_total_failures(); |
| 101 | unsigned long pool_total_allocated(); |
| 102 | unsigned long pool_total_used(); |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 103 | |
| 104 | /* |
Willy Tarreau | e6ce59d | 2007-05-13 19:38:49 +0200 | [diff] [blame] | 105 | * This function frees whatever can be freed in pool <pool>. |
| 106 | */ |
Willy Tarreau | bafbe01 | 2017-11-24 17:34:44 +0100 | [diff] [blame] | 107 | void pool_flush(struct pool_head *pool); |
Willy Tarreau | e6ce59d | 2007-05-13 19:38:49 +0200 | [diff] [blame] | 108 | |
| 109 | /* |
| 110 | * This function frees whatever can be freed in all pools, but respecting |
| 111 | * the minimum thresholds imposed by owners. |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 112 | * |
Willy Tarreau | bafbe01 | 2017-11-24 17:34:44 +0100 | [diff] [blame] | 113 | * <pool_ctx> is used when pool_gc is called to release resources to allocate |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 114 | * an element in __pool_refill_alloc. It is important because <pool_ctx> is |
| 115 | * already locked, so we need to skip the lock here. |
Willy Tarreau | e6ce59d | 2007-05-13 19:38:49 +0200 | [diff] [blame] | 116 | */ |
Willy Tarreau | bafbe01 | 2017-11-24 17:34:44 +0100 | [diff] [blame] | 117 | void pool_gc(struct pool_head *pool_ctx); |
Willy Tarreau | e6ce59d | 2007-05-13 19:38:49 +0200 | [diff] [blame] | 118 | |
| 119 | /* |
| 120 | * This function destroys a pull by freeing it completely. |
| 121 | * This should be called only under extreme circumstances. |
| 122 | */ |
Willy Tarreau | bafbe01 | 2017-11-24 17:34:44 +0100 | [diff] [blame] | 123 | void *pool_destroy(struct pool_head *pool); |
Willy Tarreau | e6ce59d | 2007-05-13 19:38:49 +0200 | [diff] [blame] | 124 | |
Olivier Houchard | cf975d4 | 2018-01-24 18:38:31 +0100 | [diff] [blame] | 125 | #ifdef HA_HAVE_CAS_DW |
| 126 | /* |
| 127 | * Returns a pointer to type <type> taken from the pool <pool_type> if |
| 128 | * available, otherwise returns NULL. No malloc() is attempted, and poisonning |
| 129 | * is never performed. The purpose is to get the fastest possible allocation. |
| 130 | */ |
| 131 | static inline void *__pool_get_first(struct pool_head *pool) |
| 132 | { |
| 133 | struct pool_free_list cmp, new; |
| 134 | |
| 135 | cmp.seq = pool->seq; |
| 136 | __ha_barrier_load(); |
| 137 | |
| 138 | cmp.free_list = pool->free_list; |
| 139 | do { |
| 140 | if (cmp.free_list == NULL) |
| 141 | return NULL; |
| 142 | new.seq = cmp.seq + 1; |
| 143 | __ha_barrier_load(); |
| 144 | new.free_list = *POOL_LINK(pool, cmp.free_list); |
| 145 | } while (__ha_cas_dw((void *)&pool->free_list, (void *)&cmp, (void *)&new) == 0); |
| 146 | end: |
| 147 | HA_ATOMIC_ADD(&pool->used, 1); |
| 148 | #ifdef DEBUG_MEMORY_POOLS |
| 149 | /* keep track of where the element was allocated from */ |
| 150 | *POOL_LINK(pool, cmp.free_list) = (void *)pool; |
| 151 | #endif |
| 152 | return cmp.free_list; |
| 153 | } |
| 154 | |
| 155 | static inline void *pool_get_first(struct pool_head *pool) |
| 156 | { |
| 157 | void *ret; |
| 158 | |
| 159 | ret = __pool_get_first(pool); |
| 160 | return ret; |
| 161 | } |
| 162 | /* |
| 163 | * Returns a pointer to type <type> taken from the pool <pool_type> or |
| 164 | * dynamically allocated. In the first case, <pool_type> is updated to point to |
| 165 | * the next element in the list. No memory poisonning is ever performed on the |
| 166 | * returned area. |
| 167 | */ |
| 168 | static inline void *pool_alloc_dirty(struct pool_head *pool) |
| 169 | { |
| 170 | void *p; |
| 171 | |
| 172 | if ((p = __pool_get_first(pool)) == NULL) |
| 173 | p = __pool_refill_alloc(pool, 0); |
| 174 | return p; |
| 175 | } |
| 176 | |
Willy Tarreau | e6ce59d | 2007-05-13 19:38:49 +0200 | [diff] [blame] | 177 | /* |
Olivier Houchard | cf975d4 | 2018-01-24 18:38:31 +0100 | [diff] [blame] | 178 | * Returns a pointer to type <type> taken from the pool <pool_type> or |
| 179 | * dynamically allocated. In the first case, <pool_type> is updated to point to |
| 180 | * the next element in the list. Memory poisonning is performed if enabled. |
| 181 | */ |
| 182 | static inline void *pool_alloc(struct pool_head *pool) |
| 183 | { |
| 184 | void *p; |
| 185 | |
| 186 | p = pool_alloc_dirty(pool); |
| 187 | #ifdef DEBUG_MEMORY_POOLS |
| 188 | if (p) { |
| 189 | /* keep track of where the element was allocated from */ |
| 190 | *POOL_LINK(pool, p) = (void *)pool; |
| 191 | } |
| 192 | #endif |
| 193 | if (p && mem_poison_byte >= 0) { |
| 194 | memset(p, mem_poison_byte, pool->size); |
| 195 | } |
| 196 | |
| 197 | return p; |
| 198 | } |
| 199 | |
| 200 | /* |
| 201 | * Puts a memory area back to the corresponding pool. |
| 202 | * Items are chained directly through a pointer that |
| 203 | * is written in the beginning of the memory area, so |
| 204 | * there's no need for any carrier cell. This implies |
| 205 | * that each memory area is at least as big as one |
| 206 | * pointer. Just like with the libc's free(), nothing |
| 207 | * is done if <ptr> is NULL. |
| 208 | */ |
| 209 | static inline void pool_free(struct pool_head *pool, void *ptr) |
| 210 | { |
| 211 | if (likely(ptr != NULL)) { |
| 212 | void *free_list; |
| 213 | #ifdef DEBUG_MEMORY_POOLS |
| 214 | /* we'll get late corruption if we refill to the wrong pool or double-free */ |
| 215 | if (*POOL_LINK(pool, ptr) != (void *)pool) |
| 216 | *(volatile int *)0 = 0; |
| 217 | #endif |
| 218 | free_list = pool->free_list; |
| 219 | do { |
| 220 | *POOL_LINK(pool, ptr) = (void *)free_list; |
| 221 | __ha_barrier_store(); |
| 222 | } while (!HA_ATOMIC_CAS(&pool->free_list, (void *)&free_list, ptr)); |
| 223 | end: |
| 224 | HA_ATOMIC_SUB(&pool->used, 1); |
| 225 | } |
| 226 | } |
| 227 | |
| 228 | #else |
| 229 | /* |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 230 | * Returns a pointer to type <type> taken from the pool <pool_type> if |
| 231 | * available, otherwise returns NULL. No malloc() is attempted, and poisonning |
| 232 | * is never performed. The purpose is to get the fastest possible allocation. |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 233 | */ |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 234 | static inline void *__pool_get_first(struct pool_head *pool) |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 235 | { |
| 236 | void *p; |
| 237 | |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 238 | if ((p = pool->free_list) != NULL) { |
Willy Tarreau | ac42111 | 2015-10-28 15:09:29 +0100 | [diff] [blame] | 239 | pool->free_list = *POOL_LINK(pool, p); |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 240 | pool->used++; |
Willy Tarreau | de30a68 | 2015-10-28 15:23:51 +0100 | [diff] [blame] | 241 | #ifdef DEBUG_MEMORY_POOLS |
| 242 | /* keep track of where the element was allocated from */ |
| 243 | *POOL_LINK(pool, p) = (void *)pool; |
| 244 | #endif |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 245 | } |
| 246 | return p; |
| 247 | } |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 248 | |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 249 | static inline void *pool_get_first(struct pool_head *pool) |
| 250 | { |
| 251 | void *ret; |
| 252 | |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 253 | HA_SPIN_LOCK(POOL_LOCK, &pool->lock); |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 254 | ret = __pool_get_first(pool); |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 255 | HA_SPIN_UNLOCK(POOL_LOCK, &pool->lock); |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 256 | return ret; |
| 257 | } |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 258 | /* |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 259 | * Returns a pointer to type <type> taken from the pool <pool_type> or |
| 260 | * dynamically allocated. In the first case, <pool_type> is updated to point to |
| 261 | * the next element in the list. No memory poisonning is ever performed on the |
| 262 | * returned area. |
| 263 | */ |
| 264 | static inline void *pool_alloc_dirty(struct pool_head *pool) |
| 265 | { |
| 266 | void *p; |
| 267 | |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 268 | HA_SPIN_LOCK(POOL_LOCK, &pool->lock); |
Christopher Faulet | b349e48 | 2017-08-29 09:52:38 +0200 | [diff] [blame] | 269 | if ((p = __pool_get_first(pool)) == NULL) |
| 270 | p = __pool_refill_alloc(pool, 0); |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 271 | HA_SPIN_UNLOCK(POOL_LOCK, &pool->lock); |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 272 | return p; |
| 273 | } |
| 274 | |
Willy Tarreau | 158fa75 | 2017-11-22 15:47:29 +0100 | [diff] [blame] | 275 | #ifndef DEBUG_UAF /* normal allocator */ |
| 276 | |
Willy Tarreau | f13322e | 2017-11-22 10:50:54 +0100 | [diff] [blame] | 277 | /* allocates an area of size <size> and returns it. The semantics are similar |
| 278 | * to those of malloc(). |
| 279 | */ |
| 280 | static inline void *pool_alloc_area(size_t size) |
| 281 | { |
| 282 | return malloc(size); |
| 283 | } |
| 284 | |
| 285 | /* frees an area <area> of size <size> allocated by pool_alloc_area(). The |
| 286 | * semantics are identical to free() except that the size is specified and |
| 287 | * may be ignored. |
| 288 | */ |
| 289 | static inline void pool_free_area(void *area, size_t __maybe_unused size) |
| 290 | { |
| 291 | free(area); |
| 292 | } |
| 293 | |
Willy Tarreau | 158fa75 | 2017-11-22 15:47:29 +0100 | [diff] [blame] | 294 | #else /* use-after-free detector */ |
| 295 | |
| 296 | /* allocates an area of size <size> and returns it. The semantics are similar |
| 297 | * to those of malloc(). However the allocation is rounded up to 4kB so that a |
| 298 | * full page is allocated. This ensures the object can be freed alone so that |
| 299 | * future dereferences are easily detected. The returned object is always |
| 300 | * 16-bytes aligned to avoid issues with unaligned structure objects. |
| 301 | */ |
| 302 | static inline void *pool_alloc_area(size_t size) |
| 303 | { |
| 304 | size_t pad = (4096 - size) & 0xFF0; |
| 305 | |
| 306 | return mmap(NULL, (size + 4095) & -4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, 0, 0) + pad; |
| 307 | } |
| 308 | |
| 309 | /* frees an area <area> of size <size> allocated by pool_alloc_area(). The |
| 310 | * semantics are identical to free() except that the size must absolutely match |
| 311 | * the one passed to pool_alloc_area(). |
| 312 | */ |
| 313 | static inline void pool_free_area(void *area, size_t size) |
| 314 | { |
| 315 | size_t pad = (4096 - size) & 0xFF0; |
| 316 | |
| 317 | munmap(area - pad, (size + 4095) & -4096); |
| 318 | } |
| 319 | |
| 320 | #endif /* DEBUG_UAF */ |
| 321 | |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 322 | /* |
| 323 | * Returns a pointer to type <type> taken from the pool <pool_type> or |
| 324 | * dynamically allocated. In the first case, <pool_type> is updated to point to |
| 325 | * the next element in the list. Memory poisonning is performed if enabled. |
| 326 | */ |
Willy Tarreau | bafbe01 | 2017-11-24 17:34:44 +0100 | [diff] [blame] | 327 | static inline void *pool_alloc(struct pool_head *pool) |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 328 | { |
| 329 | void *p; |
| 330 | |
| 331 | p = pool_alloc_dirty(pool); |
Willy Tarreau | de30a68 | 2015-10-28 15:23:51 +0100 | [diff] [blame] | 332 | #ifdef DEBUG_MEMORY_POOLS |
| 333 | if (p) { |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 334 | HA_SPIN_LOCK(POOL_LOCK, &pool->lock); |
Willy Tarreau | de30a68 | 2015-10-28 15:23:51 +0100 | [diff] [blame] | 335 | /* keep track of where the element was allocated from */ |
| 336 | *POOL_LINK(pool, p) = (void *)pool; |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 337 | HA_SPIN_UNLOCK(POOL_LOCK, &pool->lock); |
Willy Tarreau | de30a68 | 2015-10-28 15:23:51 +0100 | [diff] [blame] | 338 | } |
| 339 | #endif |
| 340 | if (p && mem_poison_byte >= 0) { |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 341 | memset(p, mem_poison_byte, pool->size); |
Willy Tarreau | de30a68 | 2015-10-28 15:23:51 +0100 | [diff] [blame] | 342 | } |
| 343 | |
Willy Tarreau | 0262241 | 2014-12-08 16:35:23 +0100 | [diff] [blame] | 344 | return p; |
| 345 | } |
| 346 | |
| 347 | /* |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 348 | * Puts a memory area back to the corresponding pool. |
| 349 | * Items are chained directly through a pointer that |
| 350 | * is written in the beginning of the memory area, so |
| 351 | * there's no need for any carrier cell. This implies |
| 352 | * that each memory area is at least as big as one |
Willy Tarreau | 48d63db | 2008-08-03 17:41:33 +0200 | [diff] [blame] | 353 | * pointer. Just like with the libc's free(), nothing |
| 354 | * is done if <ptr> is NULL. |
Willy Tarreau | 50e608d | 2007-05-13 18:26:08 +0200 | [diff] [blame] | 355 | */ |
Willy Tarreau | bafbe01 | 2017-11-24 17:34:44 +0100 | [diff] [blame] | 356 | static inline void pool_free(struct pool_head *pool, void *ptr) |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 357 | { |
| 358 | if (likely(ptr != NULL)) { |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 359 | HA_SPIN_LOCK(POOL_LOCK, &pool->lock); |
Willy Tarreau | de30a68 | 2015-10-28 15:23:51 +0100 | [diff] [blame] | 360 | #ifdef DEBUG_MEMORY_POOLS |
| 361 | /* we'll get late corruption if we refill to the wrong pool or double-free */ |
| 362 | if (*POOL_LINK(pool, ptr) != (void *)pool) |
| 363 | *(int *)0 = 0; |
| 364 | #endif |
Willy Tarreau | 158fa75 | 2017-11-22 15:47:29 +0100 | [diff] [blame] | 365 | |
| 366 | #ifndef DEBUG_UAF /* normal pool behaviour */ |
Willy Tarreau | ac42111 | 2015-10-28 15:09:29 +0100 | [diff] [blame] | 367 | *POOL_LINK(pool, ptr) = (void *)pool->free_list; |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 368 | pool->free_list = (void *)ptr; |
Willy Tarreau | 158fa75 | 2017-11-22 15:47:29 +0100 | [diff] [blame] | 369 | #else /* release the entry for real to detect use after free */ |
| 370 | /* ensure we crash on double free or free of a const area*/ |
| 371 | *(uint32_t *)ptr = 0xDEADADD4; |
| 372 | pool_free_area(ptr, pool->size + POOL_EXTRA); |
| 373 | pool->allocated--; |
| 374 | #endif /* DEBUG_UAF */ |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 375 | pool->used--; |
Christopher Faulet | 2a944ee | 2017-11-07 10:42:54 +0100 | [diff] [blame] | 376 | HA_SPIN_UNLOCK(POOL_LOCK, &pool->lock); |
Willy Tarreau | e430e77 | 2014-12-23 14:13:16 +0100 | [diff] [blame] | 377 | } |
| 378 | } |
Olivier Houchard | cf975d4 | 2018-01-24 18:38:31 +0100 | [diff] [blame] | 379 | #endif /* HA_HAVE_CAS_DW */ |
Willy Tarreau | 2dd0d47 | 2006-06-29 17:53:05 +0200 | [diff] [blame] | 380 | #endif /* _COMMON_MEMORY_H */ |
Willy Tarreau | baaee00 | 2006-06-26 02:48:02 +0200 | [diff] [blame] | 381 | |
| 382 | /* |
| 383 | * Local variables: |
| 384 | * c-indent-level: 8 |
| 385 | * c-basic-offset: 8 |
| 386 | * End: |
| 387 | */ |