1 /* $NetBSD: malloc.c,v 1.61 2026/04/28 13:24:49 riastradh Exp $ */ 2 3 /* 4 * ---------------------------------------------------------------------------- 5 * "THE BEER-WARE LICENSE" (Revision 42): 6 * <phk (at) FreeBSD.ORG> wrote this file. As long as you retain this notice you 7 * can do whatever you want with this stuff. If we meet some day, and you think 8 * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp 9 * ---------------------------------------------------------------------------- 10 * 11 * From FreeBSD: malloc.c,v 1.91 2006/01/12 07:28:20 jasone 12 * 13 */ 14 15 /* 16 * Defining MALLOC_EXTRA_SANITY will enable extra checks which are related 17 * to internal conditions and consistency in malloc.c. This has a 18 * noticeable runtime performance hit, and generally will not do you 19 * any good unless you fiddle with the internals of malloc or want 20 * to catch random pointer corruption as early as possible. 21 */ 22 #ifndef MALLOC_EXTRA_SANITY 23 #undef MALLOC_EXTRA_SANITY 24 #endif 25 26 /* 27 * What to use for Junk. This is the byte value we use to fill with 28 * when the 'J' option is enabled. 29 */ 30 #define SOME_JUNK 0xd0 /* as in "Duh" :-) */ 31 32 /* 33 * The basic parameters you can tweak. 34 * 35 * malloc_minsize minimum size of an allocation in bytes. 36 * If this is too small it's too much work 37 * to manage them. This is also the smallest 38 * unit of alignment used for the storage 39 * returned by malloc/realloc. 40 * 41 */ 42 43 #include "namespace.h" 44 #if defined(__FreeBSD__) 45 # if defined(__i386__) 46 # define malloc_minsize 16U 47 # endif 48 # if defined(__ia64__) 49 # define malloc_pageshift 13U 50 # define malloc_minsize 16U 51 # endif 52 # if defined(__alpha__) 53 # define malloc_pageshift 13U 54 # define malloc_minsize 16U 55 # endif 56 # if defined(__sparc64__) 57 # define malloc_pageshift 13U 58 # define malloc_minsize 16U 59 # endif 60 # if defined(__amd64__) 61 # define malloc_pageshift 12U 62 # define malloc_minsize 16U 63 # endif 64 # if defined(__arm__) 65 # define malloc_pageshift 12U 66 # define malloc_minsize 16U 67 # endif 68 # define HAS_UTRACE 69 # define UTRACE_LABEL 70 71 #include <sys/cdefs.h> 72 void utrace(struct ut *, int); 73 74 /* 75 * Make malloc/free/realloc thread-safe in libc for use with 76 * kernel threads. 77 */ 78 # include "libc_private.h" 79 # include "spinlock.h" 80 static spinlock_t thread_lock = _SPINLOCK_INITIALIZER; 81 # define _MALLOC_LOCK() if (__isthreaded) _SPINLOCK(&thread_lock); 82 # define _MALLOC_UNLOCK() if (__isthreaded) _SPINUNLOCK(&thread_lock); 83 # define _MALLOC_REINIT() if (__isthreaded) thread_lock = (spinlock_t)_SPINLOCK_INITIALIZER; 84 #endif /* __FreeBSD__ */ 85 86 #include <sys/types.h> 87 #if defined(__NetBSD__) 88 # define malloc_minsize 16U 89 # ifdef _LIBC 90 # define HAS_UTRACE 91 # define UTRACE_LABEL "malloc", 92 int utrace(const char *, void *, size_t); 93 # endif 94 # include <sys/cdefs.h> 95 # include "extern.h" 96 # if defined(LIBC_SCCS) && !defined(lint) 97 __RCSID("$NetBSD: malloc.c,v 1.61 2026/04/28 13:24:49 riastradh Exp $"); 98 # endif /* LIBC_SCCS and not lint */ 99 # include <reentrant.h> 100 # ifdef _REENTRANT 101 extern int __isthreaded; 102 static mutex_t thread_lock = MUTEX_INITIALIZER; 103 # define _MALLOC_LOCK() if (__isthreaded) mutex_lock(&thread_lock); 104 # define _MALLOC_UNLOCK() if (__isthreaded) mutex_unlock(&thread_lock); 105 # define _MALLOC_REINIT() if (__isthreaded) mutex_init(&thread_lock, NULL); 106 # else 107 # define _MALLOC_LOCK() 108 # define _MALLOC_UNLOCK() 109 # define _MALLOC_REINIT() 110 # endif 111 #endif /* __NetBSD__ */ 112 113 #if defined(__sparc__) && defined(sun) 114 # define malloc_minsize 16U 115 # define MAP_ANON (0) 116 static int fdzero; 117 # define MMAP_FD fdzero 118 # define INIT_MMAP() \ 119 { if ((fdzero = open(_PATH_DEVZERO, O_RDWR | O_CLOEXEC, 0000)) == -1) \ 120 wrterror("open of /dev/zero"); } 121 #endif /* __sparc__ */ 122 123 /* Insert your combination here... */ 124 #if defined(__FOOCPU__) && defined(__BAROS__) 125 # define malloc_minsize 16U 126 #endif /* __FOOCPU__ && __BAROS__ */ 127 128 #ifndef ZEROSIZEPTR 129 #define ZEROSIZEPTR ((void *)(uintptr_t)(1UL << (malloc_pageshift - 1))) 130 #endif 131 132 /* 133 * No user serviceable parts behind this point. 134 */ 135 #include <sys/types.h> 136 #include <sys/mman.h> 137 #include <errno.h> 138 #include <fcntl.h> 139 #include <paths.h> 140 #include <stddef.h> 141 #include <stdio.h> 142 #include <stdlib.h> 143 #include <string.h> 144 #include <unistd.h> 145 146 /* 147 * This structure describes a page worth of chunks. 148 */ 149 150 struct pginfo { 151 struct pginfo *next; /* next on the free list */ 152 void *page; /* Pointer to the page */ 153 u_short size; /* size of this page's chunks */ 154 u_short shift; /* How far to shift for this size chunks */ 155 u_short free; /* How many free chunks */ 156 u_short total; /* How many chunk */ 157 u_int bits[1]; /* Which chunks are free */ 158 }; 159 160 /* 161 * This structure describes a number of free pages. 162 */ 163 164 struct pgfree { 165 struct pgfree *next; /* next run of free pages */ 166 struct pgfree *prev; /* prev run of free pages */ 167 void *page; /* pointer to free pages */ 168 void *end; /* pointer to end of free pages */ 169 size_t size; /* number of bytes free */ 170 }; 171 172 /* 173 * How many bits per u_int in the bitmap. 174 * Change only if not 8 bits/byte 175 */ 176 #define MALLOC_BITS ((int)(8*sizeof(u_int))) 177 178 /* 179 * Magic values to put in the page_directory 180 */ 181 #define MALLOC_NOT_MINE ((struct pginfo*) 0) 182 #define MALLOC_FREE ((struct pginfo*) 1) 183 #define MALLOC_FIRST ((struct pginfo*) 2) 184 #define MALLOC_FOLLOW ((struct pginfo*) 3) 185 #define MALLOC_MAGIC ((struct pginfo*) 4) 186 187 /* 188 * Page size related parameters, computed at run-time. 189 */ 190 static size_t malloc_pagesize; 191 static size_t malloc_pageshift; 192 static size_t malloc_pagemask; 193 194 #ifndef malloc_minsize 195 #define malloc_minsize 16U 196 #endif 197 198 #ifndef malloc_maxsize 199 #define malloc_maxsize ((malloc_pagesize)>>1) 200 #endif 201 202 #define pageround(foo) (((foo) + (malloc_pagemask))&(~(malloc_pagemask))) 203 #define ptr2idx(foo) \ 204 (((size_t)(uintptr_t)(foo) >> malloc_pageshift)-malloc_origo) 205 206 #ifndef _MALLOC_LOCK 207 #define _MALLOC_LOCK() 208 #endif 209 210 #ifndef _MALLOC_UNLOCK 211 #define _MALLOC_UNLOCK() 212 #endif 213 214 #ifndef _MALLOC_REINIT 215 #define _MALLOC_REINIT() 216 #endif 217 218 #ifndef MMAP_FD 219 #define MMAP_FD (-1) 220 #endif 221 222 #ifndef INIT_MMAP 223 #define INIT_MMAP() 224 #endif 225 226 #ifndef MADV_FREE 227 #define MADV_FREE MADV_DONTNEED 228 #endif 229 230 /* Number of free pages we cache */ 231 static size_t malloc_cache = 16; 232 233 /* The offset from pagenumber to index into the page directory */ 234 static size_t malloc_origo; 235 236 /* The last index in the page directory we care about */ 237 static size_t last_idx; 238 239 /* Pointer to page directory. Allocated "as if with" malloc */ 240 static struct pginfo **page_dir; 241 242 /* How many slots in the page directory */ 243 static size_t malloc_ninfo; 244 245 /* Free pages line up here */ 246 static struct pgfree free_list; 247 248 /* Abort(), user doesn't handle problems. */ 249 static int malloc_abort; 250 251 /* Are we trying to die ? */ 252 static int suicide; 253 254 /* always realloc ? */ 255 static int malloc_realloc; 256 257 /* pass the kernel a hint on free pages ? */ 258 #if defined(MADV_FREE) 259 static int malloc_hint = 0; 260 #endif 261 262 /* xmalloc behaviour ? */ 263 static int malloc_xmalloc; 264 265 /* sysv behaviour for malloc(0) ? */ 266 static int malloc_sysv; 267 268 /* zero fill ? */ 269 static int malloc_zero; 270 271 /* junk fill ? */ 272 static int malloc_junk; 273 274 #ifdef HAS_UTRACE 275 276 /* utrace ? */ 277 static int malloc_utrace; 278 279 struct ut { void *p; size_t s; void *r; }; 280 281 #define UTRACE(a, b, c) \ 282 if (malloc_utrace) { \ 283 struct ut u; \ 284 u.p=a; u.s = b; u.r=c; \ 285 utrace(UTRACE_LABEL (void *) &u, sizeof u); \ 286 } 287 #else /* !HAS_UTRACE */ 288 #define UTRACE(a,b,c) 289 #endif /* HAS_UTRACE */ 290 291 /* my last break. */ 292 static void *malloc_brk; 293 294 /* one location cache for free-list holders */ 295 static struct pgfree *px; 296 297 /* compile-time options */ 298 const char *_malloc_options; 299 300 /* Name of the current public function */ 301 static const char *malloc_func; 302 303 /* Macro for mmap */ 304 #define MMAP(size) \ 305 mmap(NULL, (size), PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, \ 306 MMAP_FD, (off_t)0); 307 308 /* 309 * Necessary function declarations 310 */ 311 static int extend_pgdir(size_t idx); 312 static void *imalloc(size_t size); 313 static void ifree(void *ptr); 314 static void *irealloc(void *ptr, size_t size); 315 316 static void 317 wrtmessage(const char *p1, const char *p2, const char *p3, const char *p4) 318 { 319 320 write(STDERR_FILENO, p1, strlen(p1)); 321 write(STDERR_FILENO, p2, strlen(p2)); 322 write(STDERR_FILENO, p3, strlen(p3)); 323 write(STDERR_FILENO, p4, strlen(p4)); 324 } 325 326 void (*_malloc_message)(const char *p1, const char *p2, const char *p3, 327 const char *p4) = wrtmessage; 328 static void 329 wrterror(const char *p) 330 { 331 332 suicide = 1; 333 _malloc_message(getprogname(), malloc_func, " error: ", p); 334 abort(); 335 } 336 337 static void 338 wrtwarning(const char *p) 339 { 340 341 /* 342 * Sensitive processes, somewhat arbitrarily defined here as setuid, 343 * setgid, root and wheel cannot afford to have malloc mistakes. 344 */ 345 if (malloc_abort || issetugid() || getuid() == 0 || getgid() == 0) 346 wrterror(p); 347 } 348 349 /* 350 * Allocate a number of pages from the OS 351 */ 352 static void * 353 map_pages(size_t pages) 354 { 355 caddr_t result, rresult, tail; 356 intptr_t bytes = pages << malloc_pageshift; 357 358 if (bytes < 0 || (size_t)bytes < pages) { 359 errno = ENOMEM; 360 return NULL; 361 } 362 363 if ((result = sbrk(bytes)) == (void *)-1) 364 return NULL; 365 366 /* 367 * Round to a page, in case sbrk(2) did not do this for us 368 */ 369 rresult = (caddr_t)pageround((size_t)(uintptr_t)result); 370 if (result < rresult) { 371 /* make sure we have enough space to fit bytes */ 372 if (sbrk((intptr_t)(rresult - result)) == (void *) -1) { 373 /* we failed, put everything back */ 374 if (brk(result)) { 375 wrterror("brk(2) failed [internal error]\n"); 376 } 377 } 378 } 379 tail = rresult + (size_t)bytes; 380 381 last_idx = ptr2idx(tail) - 1; 382 malloc_brk = tail; 383 384 if ((last_idx+1) >= malloc_ninfo && !extend_pgdir(last_idx)) { 385 malloc_brk = result; 386 last_idx = ptr2idx(malloc_brk) - 1; 387 /* Put back break point since we failed. */ 388 if (brk(malloc_brk)) 389 wrterror("brk(2) failed [internal error]\n"); 390 return 0; 391 } 392 393 return rresult; 394 } 395 396 /* 397 * Extend page directory 398 */ 399 static int 400 extend_pgdir(size_t idx) 401 { 402 struct pginfo **new, **old; 403 size_t newlen, oldlen; 404 405 /* check for overflow */ 406 if ((((~(1UL << ((sizeof(size_t) * NBBY) - 1)) / sizeof(*page_dir)) + 1) 407 + (malloc_pagesize / sizeof *page_dir)) < idx) { 408 errno = ENOMEM; 409 return 0; 410 } 411 412 /* Make it this many pages */ 413 newlen = pageround(idx * sizeof *page_dir) + malloc_pagesize; 414 415 /* remember the old mapping size */ 416 oldlen = malloc_ninfo * sizeof *page_dir; 417 418 /* 419 * NOTE: we allocate new pages and copy the directory rather than tempt 420 * fate by trying to "grow" the region.. There is nothing to prevent 421 * us from accidentally re-mapping space that's been allocated by our caller 422 * via dlopen() or other mmap(). 423 * 424 * The copy problem is not too bad, as there is 4K of page index per 425 * 4MB of malloc arena. 426 * 427 * We can totally avoid the copy if we open a file descriptor to associate 428 * the anon mappings with. Then, when we remap the pages at the new 429 * address, the old pages will be "magically" remapped.. But this means 430 * keeping open a "secret" file descriptor..... 431 */ 432 433 /* Get new pages */ 434 new = MMAP(newlen); 435 if (new == MAP_FAILED) 436 return 0; 437 438 /* Copy the old stuff */ 439 memcpy(new, page_dir, oldlen); 440 441 /* register the new size */ 442 malloc_ninfo = newlen / sizeof *page_dir; 443 444 /* swap the pointers */ 445 old = page_dir; 446 page_dir = new; 447 448 /* Now free the old stuff */ 449 munmap(old, oldlen); 450 return 1; 451 } 452 453 /* 454 * Initialize the world 455 */ 456 static void 457 malloc_init(void) 458 { 459 const char *p; 460 char b[64]; 461 size_t i; 462 ssize_t j; 463 int serrno = errno; 464 465 /* 466 * Compute page-size related variables. 467 */ 468 malloc_pagesize = getpagesize(); 469 malloc_pagemask = malloc_pagesize - 1; 470 for (malloc_pageshift = 0; 471 (1UL << malloc_pageshift) != malloc_pagesize; 472 malloc_pageshift++) 473 /* nothing */ ; 474 475 INIT_MMAP(); 476 477 #ifdef MALLOC_EXTRA_SANITY 478 malloc_junk = 1; 479 #endif /* MALLOC_EXTRA_SANITY */ 480 481 for (i = 0; i < 3; i++) { 482 if (i == 0) { 483 j = readlink("/etc/malloc.conf", b, sizeof b - 1); 484 if (j == -1) 485 continue; 486 b[j] = '\0'; 487 p = b; 488 #ifdef _LIBC 489 } else if (i == 1 && issetugid() == 0) { 490 p = getenv("MALLOC_OPTIONS"); 491 #endif 492 } else if (i == 1) { 493 continue; 494 } else { 495 p = _malloc_options; 496 } 497 for (; p != NULL && *p != '\0'; p++) { 498 switch (*p) { 499 case '>': malloc_cache <<= 1; break; 500 case '<': malloc_cache >>= 1; break; 501 case 'a': malloc_abort = 0; break; 502 case 'A': malloc_abort = 1; break; 503 case 'h': malloc_hint = 0; break; 504 case 'H': malloc_hint = 1; break; 505 case 'r': malloc_realloc = 0; break; 506 case 'R': malloc_realloc = 1; break; 507 case 'j': malloc_junk = 0; break; 508 case 'J': malloc_junk = 1; break; 509 #ifdef HAS_UTRACE 510 case 'u': malloc_utrace = 0; break; 511 case 'U': malloc_utrace = 1; break; 512 #endif 513 case 'v': malloc_sysv = 0; break; 514 case 'V': malloc_sysv = 1; break; 515 case 'x': malloc_xmalloc = 0; break; 516 case 'X': malloc_xmalloc = 1; break; 517 case 'z': malloc_zero = 0; break; 518 case 'Z': malloc_zero = 1; break; 519 default: 520 _malloc_message(getprogname(), malloc_func, 521 " warning: ", "unknown char in MALLOC_OPTIONS\n"); 522 break; 523 } 524 } 525 } 526 527 UTRACE(0, 0, 0); 528 529 /* 530 * We want junk in the entire allocation, and zero only in the part 531 * the user asked for. 532 */ 533 if (malloc_zero) 534 malloc_junk = 1; 535 536 /* Allocate one page for the page directory */ 537 page_dir = MMAP(malloc_pagesize); 538 539 if (page_dir == MAP_FAILED) 540 wrterror("mmap(2) failed, check limits.\n"); 541 542 /* 543 * We need a maximum of malloc_pageshift buckets, steal these from the 544 * front of the page_directory; 545 */ 546 malloc_origo = pageround((size_t)(uintptr_t)sbrk((intptr_t)0)) 547 >> malloc_pageshift; 548 malloc_origo -= malloc_pageshift; 549 550 malloc_ninfo = malloc_pagesize / sizeof *page_dir; 551 552 /* Recalculate the cache size in bytes, and make sure it's nonzero */ 553 554 if (!malloc_cache) 555 malloc_cache++; 556 557 malloc_cache <<= malloc_pageshift; 558 559 /* 560 * This is a nice hack from Kaleb Keithly (kaleb (at) x.org). 561 * We can sbrk(2) further back when we keep this on a low address. 562 */ 563 px = imalloc(sizeof *px); 564 565 errno = serrno; 566 } 567 568 /* 569 * Allocate a number of complete pages 570 */ 571 static void * 572 malloc_pages(size_t size) 573 { 574 void *p, *delay_free = NULL; 575 size_t i; 576 struct pgfree *pf; 577 size_t idx; 578 579 idx = pageround(size); 580 if (idx < size) { 581 errno = ENOMEM; 582 return NULL; 583 } else 584 size = idx; 585 586 p = NULL; 587 588 /* Look for free pages before asking for more */ 589 for(pf = free_list.next; pf; pf = pf->next) { 590 591 #ifdef MALLOC_EXTRA_SANITY 592 if (pf->size & malloc_pagemask) 593 wrterror("(ES): junk length entry on free_list.\n"); 594 if (!pf->size) 595 wrterror("(ES): zero length entry on free_list.\n"); 596 if (pf->page == pf->end) 597 wrterror("(ES): zero entry on free_list.\n"); 598 if (pf->page > pf->end) 599 wrterror("(ES): sick entry on free_list.\n"); 600 if ((void*)pf->page >= (void*)sbrk(0)) 601 wrterror("(ES): entry on free_list past brk.\n"); 602 if (page_dir[ptr2idx(pf->page)] != MALLOC_FREE) 603 wrterror("(ES): non-free first page on free-list.\n"); 604 if (page_dir[ptr2idx(pf->end)-1] != MALLOC_FREE) 605 wrterror("(ES): non-free last page on free-list.\n"); 606 #endif /* MALLOC_EXTRA_SANITY */ 607 608 if (pf->size < size) 609 continue; 610 611 if (pf->size == size) { 612 p = pf->page; 613 if (pf->next != NULL) 614 pf->next->prev = pf->prev; 615 pf->prev->next = pf->next; 616 delay_free = pf; 617 break; 618 } 619 620 p = pf->page; 621 pf->page = (char *)pf->page + size; 622 pf->size -= size; 623 break; 624 } 625 626 #ifdef MALLOC_EXTRA_SANITY 627 if (p != NULL && page_dir[ptr2idx(p)] != MALLOC_FREE) 628 wrterror("(ES): allocated non-free page on free-list.\n"); 629 #endif /* MALLOC_EXTRA_SANITY */ 630 631 size >>= malloc_pageshift; 632 633 /* Map new pages */ 634 if (p == NULL) 635 p = map_pages(size); 636 637 if (p != NULL) { 638 639 idx = ptr2idx(p); 640 page_dir[idx] = MALLOC_FIRST; 641 for (i=1;i<size;i++) 642 page_dir[idx+i] = MALLOC_FOLLOW; 643 644 if (malloc_junk) 645 memset(p, SOME_JUNK, size << malloc_pageshift); 646 } 647 648 if (delay_free) { 649 if (px == NULL) 650 px = delay_free; 651 else 652 ifree(delay_free); 653 } 654 655 return p; 656 } 657 658 /* 659 * Allocate a page of fragments 660 */ 661 662 static inline int 663 malloc_make_chunks(int bits) 664 { 665 struct pginfo *bp; 666 void *pp; 667 int i, k; 668 long l; 669 670 /* Allocate a new bucket */ 671 pp = malloc_pages(malloc_pagesize); 672 if (pp == NULL) 673 return 0; 674 675 /* Find length of admin structure */ 676 l = (long)offsetof(struct pginfo, bits[0]); 677 l += (long)sizeof bp->bits[0] * 678 (((malloc_pagesize >> bits)+MALLOC_BITS-1) / MALLOC_BITS); 679 680 /* Don't waste more than two chunks on this */ 681 if ((1<<(bits)) <= l+l) { 682 bp = (struct pginfo *)pp; 683 } else { 684 bp = imalloc((size_t)l); 685 if (bp == NULL) { 686 ifree(pp); 687 return 0; 688 } 689 } 690 691 bp->size = (1<<bits); 692 bp->shift = bits; 693 bp->total = bp->free = (u_short)(malloc_pagesize >> bits); 694 bp->page = pp; 695 696 /* set all valid bits in the bitmap */ 697 k = bp->total; 698 i = 0; 699 700 /* Do a bunch at a time */ 701 for(;k-i >= MALLOC_BITS; i += MALLOC_BITS) 702 bp->bits[i / MALLOC_BITS] = ~0U; 703 704 for(; i < k; i++) 705 bp->bits[i/MALLOC_BITS] |= 1<<(i%MALLOC_BITS); 706 707 if (bp == bp->page) { 708 /* Mark the ones we stole for ourselves */ 709 for(i = 0; l > 0; i++) { 710 bp->bits[i / MALLOC_BITS] &= ~(1 << (i % MALLOC_BITS)); 711 bp->free--; 712 bp->total--; 713 l -= (long)(1 << bits); 714 } 715 } 716 717 /* MALLOC_LOCK */ 718 719 page_dir[ptr2idx(pp)] = bp; 720 721 bp->next = page_dir[bits]; 722 page_dir[bits] = bp; 723 724 /* MALLOC_UNLOCK */ 725 726 return 1; 727 } 728 729 /* 730 * Allocate a fragment 731 */ 732 static void * 733 malloc_bytes(size_t size) 734 { 735 size_t i; 736 int j; 737 u_int u; 738 struct pginfo *bp; 739 size_t k; 740 u_int *lp; 741 742 /* Don't bother with anything less than this */ 743 if (size < malloc_minsize) 744 size = malloc_minsize; 745 746 747 /* Find the right bucket */ 748 j = 1; 749 i = size-1; 750 while (i >>= 1) 751 j++; 752 753 /* If it's empty, make a page more of that size chunks */ 754 if (page_dir[j] == NULL && !malloc_make_chunks(j)) 755 return NULL; 756 757 bp = page_dir[j]; 758 759 /* Find first word of bitmap which isn't empty */ 760 for (lp = bp->bits; !*lp; lp++) 761 ; 762 763 /* Find that bit, and tweak it */ 764 u = 1; 765 k = 0; 766 while (!(*lp & u)) { 767 u += u; 768 k++; 769 } 770 *lp ^= u; 771 772 /* If there are no more free, remove from free-list */ 773 if (!--bp->free) { 774 page_dir[j] = bp->next; 775 bp->next = NULL; 776 } 777 778 /* Adjust to the real offset of that chunk */ 779 k += (lp-bp->bits)*MALLOC_BITS; 780 k <<= bp->shift; 781 782 if (malloc_junk) 783 memset((u_char*)bp->page + k, SOME_JUNK, (size_t)bp->size); 784 785 return (u_char *)bp->page + k; 786 } 787 788 /* 789 * Allocate a piece of memory 790 */ 791 static void * 792 imalloc(size_t size) 793 { 794 void *result; 795 796 if (suicide) 797 abort(); 798 799 if ((size + malloc_pagesize) < size) /* Check for overflow */ 800 result = NULL; 801 else if ((size + malloc_pagesize) >= (uintptr_t)page_dir) 802 result = NULL; 803 else if (size <= malloc_maxsize) 804 result = malloc_bytes(size); 805 else 806 result = malloc_pages(size); 807 808 if (malloc_abort && result == NULL) 809 wrterror("allocation failed.\n"); 810 811 if (malloc_zero && result != NULL) 812 memset(result, 0, size); 813 814 return result; 815 } 816 817 /* 818 * Change the size of an allocation. 819 */ 820 static void * 821 irealloc(void *ptr, size_t size) 822 { 823 void *p; 824 size_t osize, idx; 825 struct pginfo **mp; 826 size_t i; 827 828 if (suicide) 829 abort(); 830 831 idx = ptr2idx(ptr); 832 833 if (idx < malloc_pageshift) { 834 wrtwarning("junk pointer, too low to make sense.\n"); 835 return 0; 836 } 837 838 if (idx > last_idx) { 839 wrtwarning("junk pointer, too high to make sense.\n"); 840 return 0; 841 } 842 843 mp = &page_dir[idx]; 844 845 if (*mp == MALLOC_FIRST) { /* Page allocation */ 846 847 /* Check the pointer */ 848 if ((size_t)(uintptr_t)ptr & malloc_pagemask) { 849 wrtwarning("modified (page-) pointer.\n"); 850 return NULL; 851 } 852 853 /* Find the size in bytes */ 854 for (osize = malloc_pagesize; *++mp == MALLOC_FOLLOW;) 855 osize += malloc_pagesize; 856 857 if (!malloc_realloc && /* unless we have to, */ 858 size <= osize && /* .. or are too small, */ 859 size > (osize - malloc_pagesize)) { /* .. or can free a page, */ 860 if (malloc_junk) 861 memset((u_char *)ptr + size, SOME_JUNK, osize-size); 862 return ptr; /* don't do anything. */ 863 } 864 865 } else if (*mp >= MALLOC_MAGIC) { /* Chunk allocation */ 866 867 /* Check the pointer for sane values */ 868 if (((size_t)(uintptr_t)ptr & ((*mp)->size-1))) { 869 wrtwarning("modified (chunk-) pointer.\n"); 870 return NULL; 871 } 872 873 /* Find the chunk index in the page */ 874 i = ((size_t)(uintptr_t)ptr & malloc_pagemask) >> (*mp)->shift; 875 876 /* Verify that it isn't a free chunk already */ 877 if ((*mp)->bits[i/MALLOC_BITS] & (1UL << (i % MALLOC_BITS))) { 878 wrtwarning("chunk is already free.\n"); 879 return NULL; 880 } 881 882 osize = (*mp)->size; 883 884 if (!malloc_realloc && /* Unless we have to, */ 885 size <= osize && /* ..or are too small, */ 886 (size > osize / 2 || /* ..or could use a smaller size, */ 887 osize == malloc_minsize)) { /* ..(if there is one) */ 888 if (malloc_junk) 889 memset((u_char *)ptr + size, SOME_JUNK, osize-size); 890 return ptr; /* ..Don't do anything */ 891 } 892 893 } else { 894 wrtwarning("pointer to wrong page.\n"); 895 return NULL; 896 } 897 898 p = imalloc(size); 899 900 if (p != NULL) { 901 /* copy the lesser of the two sizes, and free the old one */ 902 if (!size || !osize) 903 ; 904 else if (osize < size) 905 memcpy(p, ptr, osize); 906 else 907 memcpy(p, ptr, size); 908 ifree(ptr); 909 } 910 return p; 911 } 912 913 /* 914 * Free a sequence of pages 915 */ 916 917 static inline void 918 free_pages(void *ptr, size_t idx, struct pginfo *info) 919 { 920 size_t i; 921 struct pgfree *pf, *pt=NULL; 922 size_t l; 923 void *tail; 924 925 if (info == MALLOC_FREE) { 926 wrtwarning("page is already free.\n"); 927 return; 928 } 929 930 if (info != MALLOC_FIRST) { 931 wrtwarning("pointer to wrong page.\n"); 932 return; 933 } 934 935 if ((size_t)(uintptr_t)ptr & malloc_pagemask) { 936 wrtwarning("modified (page-) pointer.\n"); 937 return; 938 } 939 940 /* Count how many pages and mark them free at the same time */ 941 page_dir[idx] = MALLOC_FREE; 942 for (i = 1; page_dir[idx+i] == MALLOC_FOLLOW; i++) 943 page_dir[idx + i] = MALLOC_FREE; 944 945 l = i << malloc_pageshift; 946 947 if (malloc_junk) 948 memset(ptr, SOME_JUNK, l); 949 950 if (malloc_hint) 951 madvise(ptr, l, MADV_FREE); 952 953 tail = (char *)ptr+l; 954 955 /* add to free-list */ 956 if (px == NULL) 957 px = imalloc(sizeof *px); /* This cannot fail... */ 958 px->page = ptr; 959 px->end = tail; 960 px->size = l; 961 if (free_list.next == NULL) { 962 963 /* Nothing on free list, put this at head */ 964 px->next = free_list.next; 965 px->prev = &free_list; 966 free_list.next = px; 967 pf = px; 968 px = NULL; 969 970 } else { 971 972 /* Find the right spot, leave pf pointing to the modified entry. */ 973 tail = (char *)ptr+l; 974 975 for(pf = free_list.next; pf->end < ptr && pf->next != NULL; 976 pf = pf->next) 977 ; /* Race ahead here */ 978 979 if (pf->page > tail) { 980 /* Insert before entry */ 981 px->next = pf; 982 px->prev = pf->prev; 983 pf->prev = px; 984 px->prev->next = px; 985 pf = px; 986 px = NULL; 987 } else if (pf->end == ptr ) { 988 /* Append to the previous entry */ 989 pf->end = (char *)pf->end + l; 990 pf->size += l; 991 if (pf->next != NULL && pf->end == pf->next->page ) { 992 /* And collapse the next too. */ 993 pt = pf->next; 994 pf->end = pt->end; 995 pf->size += pt->size; 996 pf->next = pt->next; 997 if (pf->next != NULL) 998 pf->next->prev = pf; 999 } 1000 } else if (pf->page == tail) { 1001 /* Prepend to entry */ 1002 pf->size += l; 1003 pf->page = ptr; 1004 } else if (pf->next == NULL) { 1005 /* Append at tail of chain */ 1006 px->next = NULL; 1007 px->prev = pf; 1008 pf->next = px; 1009 pf = px; 1010 px = NULL; 1011 } else { 1012 wrterror("freelist is destroyed.\n"); 1013 } 1014 } 1015 1016 /* Return something to OS ? */ 1017 if (pf->next == NULL && /* If we're the last one, */ 1018 pf->size > malloc_cache && /* ..and the cache is full, */ 1019 pf->end == malloc_brk && /* ..and none behind us, */ 1020 malloc_brk == sbrk((intptr_t)0)) { /* ..and it's OK to do... */ 1021 1022 /* 1023 * Keep the cache intact. Notice that the '>' above guarantees that 1024 * the pf will always have at least one page afterwards. 1025 */ 1026 pf->end = (char *)pf->page + malloc_cache; 1027 pf->size = malloc_cache; 1028 1029 brk(pf->end); 1030 malloc_brk = pf->end; 1031 1032 idx = ptr2idx(pf->end); 1033 1034 for(i=idx;i <= last_idx;) 1035 page_dir[i++] = MALLOC_NOT_MINE; 1036 1037 last_idx = idx - 1; 1038 1039 /* XXX: We could realloc/shrink the pagedir here I guess. */ 1040 } 1041 if (pt != NULL) 1042 ifree(pt); 1043 } 1044 1045 /* 1046 * Free a chunk, and possibly the page it's on, if the page becomes empty. 1047 */ 1048 1049 static inline void 1050 free_bytes(void *ptr, size_t idx, struct pginfo *info) 1051 { 1052 size_t i; 1053 struct pginfo **mp; 1054 void *vp; 1055 1056 /* Find the chunk number on the page */ 1057 i = ((size_t)(uintptr_t)ptr & malloc_pagemask) >> info->shift; 1058 1059 if (((size_t)(uintptr_t)ptr & (info->size-1))) { 1060 wrtwarning("modified (chunk-) pointer.\n"); 1061 return; 1062 } 1063 1064 if (info->bits[i/MALLOC_BITS] & (1UL << (i % MALLOC_BITS))) { 1065 wrtwarning("chunk is already free.\n"); 1066 return; 1067 } 1068 1069 if (malloc_junk) 1070 memset(ptr, SOME_JUNK, (size_t)info->size); 1071 1072 info->bits[i/MALLOC_BITS] |= (u_int)(1UL << (i % MALLOC_BITS)); 1073 info->free++; 1074 1075 mp = page_dir + info->shift; 1076 1077 if (info->free == 1) { 1078 1079 /* Page became non-full */ 1080 1081 mp = page_dir + info->shift; 1082 /* Insert in address order */ 1083 while (*mp && (*mp)->next && (*mp)->next->page < info->page) 1084 mp = &(*mp)->next; 1085 info->next = *mp; 1086 *mp = info; 1087 return; 1088 } 1089 1090 if (info->free != info->total) 1091 return; 1092 1093 /* Find & remove this page in the queue */ 1094 while (*mp != info) { 1095 mp = &((*mp)->next); 1096 #ifdef MALLOC_EXTRA_SANITY 1097 if (!*mp) 1098 wrterror("(ES): Not on queue.\n"); 1099 #endif /* MALLOC_EXTRA_SANITY */ 1100 } 1101 *mp = info->next; 1102 1103 /* Free the page & the info structure if need be */ 1104 page_dir[idx] = MALLOC_FIRST; 1105 vp = info->page; /* Order is important ! */ 1106 if(vp != (void*)info) 1107 ifree(info); 1108 ifree(vp); 1109 } 1110 1111 static void 1112 ifree(void *ptr) 1113 { 1114 struct pginfo *info; 1115 size_t idx; 1116 1117 /* This is legal */ 1118 if (ptr == NULL) 1119 return; 1120 1121 /* If we're already sinking, don't make matters any worse. */ 1122 if (suicide) 1123 return; 1124 1125 idx = ptr2idx(ptr); 1126 1127 if (idx < malloc_pageshift) { 1128 wrtwarning("junk pointer, too low to make sense.\n"); 1129 return; 1130 } 1131 1132 if (idx > last_idx) { 1133 wrtwarning("junk pointer, too high to make sense.\n"); 1134 return; 1135 } 1136 1137 info = page_dir[idx]; 1138 1139 if (info < MALLOC_MAGIC) 1140 free_pages(ptr, idx, info); 1141 else 1142 free_bytes(ptr, idx, info); 1143 return; 1144 } 1145 1146 static int malloc_active; /* Recursion flag for public interface. */ 1147 static unsigned malloc_started; /* Set when initialization has been done */ 1148 1149 static void * 1150 pubrealloc(void *ptr, size_t size, const char *func) 1151 { 1152 void *r; 1153 int err = 0; 1154 1155 /* 1156 * If a thread is inside our code with a functional lock held, and then 1157 * catches a signal which calls us again, we would get a deadlock if the 1158 * lock is not of a recursive type. 1159 */ 1160 _MALLOC_LOCK(); 1161 malloc_func = func; 1162 if (malloc_active > 0) { 1163 if (malloc_active == 1) { 1164 wrtwarning("recursive call\n"); 1165 malloc_active = 2; 1166 } 1167 _MALLOC_UNLOCK(); 1168 errno = EINVAL; 1169 return (NULL); 1170 } 1171 malloc_active = 1; 1172 1173 if (!malloc_started) { 1174 if (ptr != NULL) { 1175 wrtwarning("malloc() has never been called\n"); 1176 malloc_active = 0; 1177 _MALLOC_UNLOCK(); 1178 errno = EINVAL; 1179 return (NULL); 1180 } 1181 malloc_init(); 1182 malloc_started = 1; 1183 } 1184 1185 if (ptr == ZEROSIZEPTR) 1186 ptr = NULL; 1187 if (malloc_sysv && !size) { 1188 if (ptr != NULL) 1189 ifree(ptr); 1190 r = NULL; 1191 } else if (!size) { 1192 if (ptr != NULL) 1193 ifree(ptr); 1194 r = ZEROSIZEPTR; 1195 } else if (ptr == NULL) { 1196 r = imalloc(size); 1197 err = (r == NULL); 1198 } else { 1199 r = irealloc(ptr, size); 1200 err = (r == NULL); 1201 } 1202 UTRACE(ptr, size, r); 1203 malloc_active = 0; 1204 _MALLOC_UNLOCK(); 1205 if (malloc_xmalloc && err) 1206 wrterror("out of memory\n"); 1207 if (err) 1208 errno = ENOMEM; 1209 return (r); 1210 } 1211 1212 /* 1213 * These are the public exported interface routines. 1214 */ 1215 1216 void * 1217 malloc(size_t size) 1218 { 1219 1220 return pubrealloc(NULL, size, " in malloc():"); 1221 } 1222 1223 int 1224 posix_memalign(void **memptr, size_t alignment, size_t size) 1225 { 1226 int err; 1227 void *result; 1228 1229 if (!malloc_started) { 1230 malloc_init(); 1231 malloc_started = 1; 1232 } 1233 /* Make sure that alignment is a large enough power of 2. */ 1234 if (((alignment - 1) & alignment) != 0 || alignment < sizeof(void *) || 1235 alignment > malloc_pagesize) 1236 return EINVAL; 1237 1238 /* 1239 * (size | alignment) is enough to assure the requested alignment, since 1240 * the allocator always allocates power-of-two blocks. 1241 */ 1242 err = errno; /* Protect errno against changes in pubrealloc(). */ 1243 result = pubrealloc(NULL, (size | alignment), " in posix_memalign()"); 1244 errno = err; 1245 1246 if (result == NULL) 1247 return ENOMEM; 1248 1249 *memptr = result; 1250 return 0; 1251 } 1252 1253 void * 1254 calloc(size_t num, size_t size) 1255 { 1256 void *ret; 1257 1258 if (size != 0 && (num * size) / size != num) { 1259 /* size_t overflow. */ 1260 errno = ENOMEM; 1261 return (NULL); 1262 } 1263 1264 ret = pubrealloc(NULL, num * size, " in calloc():"); 1265 1266 if (ret != NULL) 1267 memset(ret, 0, num * size); 1268 1269 return ret; 1270 } 1271 1272 void 1273 free(void *ptr) 1274 { 1275 1276 pubrealloc(ptr, 0, " in free():"); 1277 } 1278 1279 void * 1280 realloc(void *ptr, size_t size) 1281 { 1282 1283 return pubrealloc(ptr, size, " in realloc():"); 1284 } 1285 1286 /* 1287 * Begin library-private functions, used by threading libraries for protection 1288 * of malloc during fork(). These functions are only called if the program is 1289 * running in threaded mode, so there is no need to check whether the program 1290 * is threaded here. 1291 */ 1292 1293 void 1294 _malloc_prefork(void) 1295 { 1296 1297 _MALLOC_LOCK(); 1298 } 1299 1300 void 1301 _malloc_postfork(void) 1302 { 1303 1304 _MALLOC_UNLOCK(); 1305 } 1306 1307 void 1308 _malloc_postfork_child(void) 1309 { 1310 1311 _MALLOC_REINIT(); 1312 } 1313
Indexes created Sun Oct 25 00:26:45 UTC 2026