From 060e0c868a6f856e41a198e78457672b97bbf76e Mon Sep 17 00:00:00 2001 From: Michael Anthony Knyszek Date: Mon, 13 Jul 2020 19:51:50 +0000 Subject: [PATCH] [release-branch.go.1.14] runtime: validate candidate searchAddr in pageAlloc.find Currently pageAlloc.find attempts to find a better estimate for the first free page in the heap, even if the space its looking for isn't necessarily going to be the first free page in the heap (e.g. if npages >= 2). However, in doing so it has the potential to return a searchAddr candidate that doesn't actually correspond to mapped memory, but this candidate might still be adopted. As a result, pageAlloc.alloc's fast path may look at unmapped summary memory and segfault. This case is rare on most operating systems since the heap is kept fairly contiguous, so the chance that the candidate searchAddr discovered is unmapped is fairly low. Even so, this is totally possible and outside the user's control when it happens (in fact, it's likely to happen consistently for a given user on a given system). Fix this problem by ensuring that our candidate always points to mapped memory. We do this by looking at mheap's arenas structure first. If it turns out our candidate doesn't correspond to mapped memory, then we look at inUse to round up the searchAddr to the next mapped address. While we're here, clean up some documentation related to searchAddr. For #40191. Fixes #40192. Change-Id: I759efec78987e4a8fde466ae45aabbaa3d9d4214 Reviewed-on: https://go-review.googlesource.com/c/go/+/242680 Run-TryBot: Michael Knyszek Reviewed-by: Austin Clements Reviewed-by: Michael Pratt TryBot-Result: Gobot Gobot (cherry picked from commit b56791cdea5caa87ffcd585d29c294bd3d08a06a) Reviewed-on: https://go-review.googlesource.com/c/go/+/246197 Run-TryBot: Dmitri Shuralyov --- src/runtime/mpagealloc.go | 33 ++++++++++++++++++-- src/runtime/mpagealloc_test.go | 57 ++++++++++++++++++++++++++++++++++ src/runtime/mranges.go | 19 ++++++++++++ 3 files changed, 106 insertions(+), 3 deletions(-) diff --git a/src/runtime/mpagealloc.go b/src/runtime/mpagealloc.go index bb751f1f8edff6..3c56b6041bca57 100644 --- a/src/runtime/mpagealloc.go +++ b/src/runtime/mpagealloc.go @@ -227,7 +227,9 @@ type pageAlloc struct { // The address to start an allocation search with. It must never // point to any memory that is not contained in inUse, i.e. - // inUse.contains(searchAddr) must always be true. + // inUse.contains(searchAddr) must always be true. The one + // exception to this rule is that it may take on the value of + // maxSearchAddr to indicate that the heap is exhausted. // // When added with arenaBaseOffset, we guarantee that // all valid heap addresses (when also added with @@ -517,6 +519,30 @@ func (s *pageAlloc) allocRange(base, npages uintptr) uintptr { return uintptr(scav) * pageSize } +// findMappedAddr returns the smallest mapped virtual address that is +// >= addr. That is, if addr refers to mapped memory, then it is +// returned. If addr is higher than any mapped region, then +// it returns maxSearchAddr. +// +// s.mheapLock must be held. +func (s *pageAlloc) findMappedAddr(addr uintptr) uintptr { + // If we're not in a test, validate first by checking mheap_.arenas. + // This is a fast path which is only safe to use outside of testing. + ai := arenaIndex(addr) + if s.test || mheap_.arenas[ai.l1()] == nil || mheap_.arenas[ai.l1()][ai.l2()] == nil { + vAddr, ok := s.inUse.findAddrGreaterEqual(addr) + if ok { + return vAddr + } else { + // The candidate search address is greater than any + // known address, which means we definitely have no + // free memory left. + return maxSearchAddr + } + } + return addr +} + // find searches for the first (address-ordered) contiguous free region of // npages in size and returns a base address for that region. // @@ -525,6 +551,7 @@ func (s *pageAlloc) allocRange(base, npages uintptr) uintptr { // // find also computes and returns a candidate s.searchAddr, which may or // may not prune more of the address space than s.searchAddr already does. +// This candidate is always a valid s.searchAddr. // // find represents the slow path and the full radix tree search. // @@ -694,7 +721,7 @@ nextLevel: // We found a sufficiently large run of free pages straddling // some boundary, so compute the address and return it. addr := uintptr(i<= addr. Thus, if the address is represented by a, +// then it returns addr. The second return value indicates whether +// such an address exists for addr in a. That is, if addr is larger than +// any address known to a, the second return value will be false. +func (a *addrRanges) findAddrGreaterEqual(addr uintptr) (uintptr, bool) { + i := a.findSucc(addr) + if i == 0 { + return a.ranges[0].base, true + } + if a.ranges[i-1].contains(addr) { + return addr, true + } + if i < len(a.ranges) { + return a.ranges[i].base, true + } + return 0, false +} + // contains returns true if a covers the address addr. func (a *addrRanges) contains(addr uintptr) bool { i := a.findSucc(addr)