Skip to content

Commit cda2320

Browse files
committed
Fixes occasional UMM_POISON failure
Bug introduced with PR fix esp8266#8914. When a reallocated pointer could not grow in place, a replacement allocation was created. Then UMM_POISON was written to the wrong block.
1 parent 521ae60 commit cda2320

File tree

2 files changed

+11
-11
lines changed

2 files changed

+11
-11
lines changed

cores/esp8266/umm_malloc/umm_malloc.cpp

+5-5
Original file line numberDiff line numberDiff line change
@@ -928,7 +928,7 @@ void *umm_realloc(void *ptr, size_t size) {
928928

929929
uint16_t c;
930930

931-
size_t curSize;
931+
[[maybe_unused]] size_t curSize;
932932

933933
UMM_CHECK_INITIALIZED();
934934

@@ -1089,7 +1089,7 @@ void *umm_realloc(void *ptr, size_t size) {
10891089
STATS__FREE_BLOCKS_UPDATE(-prevBlockSize);
10901090
STATS__FREE_BLOCKS_ISR_MIN();
10911091
blockSize += prevBlockSize;
1092-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size); // Fix allocation so ISR poison check is good
1092+
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size); // Fix new allocation so poison check from an ISR passes.
10931093
UMM_CRITICAL_SUSPEND(id_realloc);
10941094
UMM_POISON_MEMMOVE((void *)&UMM_DATA(c), ptr, curSize);
10951095
ptr = (void *)&UMM_DATA(c);
@@ -1123,7 +1123,7 @@ void *umm_realloc(void *ptr, size_t size) {
11231123
void *oldptr = ptr;
11241124
if ((ptr = umm_malloc_core(_context, size))) {
11251125
DBGLOG_DEBUG("realloc %i to a bigger block %i, copy, and free the old\n", blockSize, blocks);
1126-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size);
1126+
(void)POISON_CHECK_SET_POISON(ptr, size);
11271127
UMM_CRITICAL_SUSPEND(id_realloc);
11281128
UMM_POISON_MEMCPY(ptr, oldptr, curSize);
11291129
UMM_CRITICAL_RESUME(id_realloc);
@@ -1204,7 +1204,7 @@ void *umm_realloc(void *ptr, size_t size) {
12041204
void *oldptr = ptr;
12051205
if ((ptr = umm_malloc_core(_context, size))) {
12061206
DBGLOG_DEBUG("realloc %d to a bigger block %d, copy, and free the old\n", blockSize, blocks);
1207-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size);
1207+
(void)POISON_CHECK_SET_POISON(ptr, size);
12081208
UMM_CRITICAL_SUSPEND(id_realloc);
12091209
UMM_POISON_MEMCPY(ptr, oldptr, curSize);
12101210
UMM_CRITICAL_RESUME(id_realloc);
@@ -1230,7 +1230,7 @@ void *umm_realloc(void *ptr, size_t size) {
12301230
void *oldptr = ptr;
12311231
if ((ptr = umm_malloc_core(_context, size))) {
12321232
DBGLOG_DEBUG("realloc %d to a bigger block %d, copy, and free the old\n", blockSize, blocks);
1233-
POISON_CHECK_SET_POISON((void *)&UMM_DATA(c), size);
1233+
(void)POISON_CHECK_SET_POISON(ptr, size);
12341234
UMM_CRITICAL_SUSPEND(id_realloc);
12351235
UMM_POISON_MEMCPY(ptr, oldptr, curSize);
12361236
UMM_CRITICAL_RESUME(id_realloc);

cores/esp8266/umm_malloc/umm_malloc_cfg.h

+6-6
Original file line numberDiff line numberDiff line change
@@ -620,7 +620,10 @@ void *umm_poison_realloc_fl(void *ptr, size_t size, const char *file, int line);
620620
void umm_poison_free_fl(void *ptr, const char *file, int line);
621621
#define POISON_CHECK_SET_POISON(p, s) get_poisoned(p, s)
622622
#define UMM_POISON_SKETCH_PTR(p) ((void*)((uintptr_t)p + sizeof(UMM_POISONED_BLOCK_LEN_TYPE) + UMM_POISON_SIZE_BEFORE))
623-
#define UMM_POISON_SKETCH_PTRSZ(s) (s - sizeof(UMM_POISONED_BLOCK_LEN_TYPE) - UMM_POISON_SIZE_BEFORE - UMM_POISON_SIZE_AFTER)
623+
#define UMM_POISON_SKETCH_PTRSZ(p) (*(UMM_POISONED_BLOCK_LEN_TYPE *)p)
624+
#define UMM_POISON_MEMMOVE(t, p, s) memmove(UMM_POISON_SKETCH_PTR(t), UMM_POISON_SKETCH_PTR(p), UMM_POISON_SKETCH_PTRSZ(p))
625+
#define UMM_POISON_MEMCPY(t, p, s) memcpy(UMM_POISON_SKETCH_PTR(t), UMM_POISON_SKETCH_PTR(p), UMM_POISON_SKETCH_PTRSZ(p))
626+
624627
#if defined(UMM_POISON_CHECK_LITE)
625628
/*
626629
* We can safely do individual poison checks at free and realloc and stay
@@ -641,13 +644,10 @@ void umm_poison_free_fl(void *ptr, const char *file, int line);
641644
#define POISON_CHECK() 1
642645
#define POISON_CHECK_NEIGHBORS(c) do {} while (false)
643646
#define POISON_CHECK_SET_POISON(p, s) (p)
644-
#define UMM_POISON_SKETCH_PTR(p) (p)
645-
#define UMM_POISON_SKETCH_PTRSZ(s) (s)
647+
#define UMM_POISON_MEMMOVE(t, p, s) memmove((t), (p), (s))
648+
#define UMM_POISON_MEMCPY(t, p, s) memcpy((t), (p), (s))
646649
#endif
647650

648-
#define UMM_POISON_MEMMOVE(t, p, s) memmove(UMM_POISON_SKETCH_PTR(t), UMM_POISON_SKETCH_PTR(p), UMM_POISON_SKETCH_PTRSZ(s))
649-
#define UMM_POISON_MEMCPY(t, p, s) memcpy(UMM_POISON_SKETCH_PTR(t), UMM_POISON_SKETCH_PTR(p), UMM_POISON_SKETCH_PTRSZ(s))
650-
651651
#if defined(UMM_POISON_CHECK) || defined(UMM_POISON_CHECK_LITE)
652652
/*
653653
* Overhead adjustments needed for free_blocks to express the number of bytes

0 commit comments

Comments
 (0)