summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKumar Gala <galak@kernel.crashing.org>2010-11-15 18:41:43 -0600
committerWolfgang Denk <wd@denx.de>2010-11-17 22:06:40 +0100
commit6163f5b4c8873848ed023054bc401727301ea537 (patch)
treec5d30fddecb595e8839aabaed4d551f2394de3f8
parentf7ac99fdd9eaf64df9731c2e8fdf97e9d3e2c82a (diff)
downloadu-boot-imx-6163f5b4c8873848ed023054bc401727301ea537.zip
u-boot-imx-6163f5b4c8873848ed023054bc401727301ea537.tar.gz
u-boot-imx-6163f5b4c8873848ed023054bc401727301ea537.tar.bz2
malloc: Fix issue with calloc memory possibly being non-zero
Since we set #define MORECORE_CLEARS 1, the code assumes 'sbrk' always returns zero'd out memory. However since its possible that free() returns memory back to sbrk() via malloc_trim we could possible get non-zero'd memory from sbrk(). This is a problem for when code might call calloc() and expect the memory to have been zero'd out. There are two possible solutions to this problem. 1. change #define MORECORE_CLEARS 0 2. memset to zero memory returned to sbrk. We go with the second since the sbrk being called to free up memory should be pretty rare. The following code problems an example test to show the issue. This test code was inserted right after the call to mem_malloc_init(). ... u8 *p2; int i; printf("MALLOC TEST\n"); p1 = malloc(135176); printf("P1 = %p\n", p1); memset(p1, 0xab, 135176); free(p1); p2 = calloc(4097, 1); printf("P2 = %p %p\n", p2, p2 + 4097); for (i = 0; i < 4097; i++) { if (p2[i] != 0) printf("miscompare at byte %d got %x\n", i, p2[i]); free(p2); printf("END MALLOC TEST\n\n"); ... Signed-off-by: Kumar Gala <galak@kernel.crashing.org> Tested-by: Wolfgang Denk <wd@denx.de>
-rw-r--r--common/dlmalloc.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/common/dlmalloc.c b/common/dlmalloc.c
index 4871f4b..e9bab09 100644
--- a/common/dlmalloc.c
+++ b/common/dlmalloc.c
@@ -1511,6 +1511,13 @@ void *sbrk(ptrdiff_t increment)
ulong old = mem_malloc_brk;
ulong new = old + increment;
+ /*
+ * if we are giving memory back make sure we clear it out since
+ * we set MORECORE_CLEARS to 1
+ */
+ if (increment < 0)
+ memset((void *)new, 0, -increment);
+
if ((new < mem_malloc_start) || (new > mem_malloc_end))
return (void *)MORECORE_FAILURE;