Skip to content

Commit 4da0e46

Browse files
danogdanog
committed
More poisoning
1 parent d6d54db commit 4da0e46

File tree

1 file changed

+47
-3
lines changed

1 file changed

+47
-3
lines changed

‎Zend/zend_alloc.c‎

Lines changed: 47 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1476,8 +1476,10 @@ static zend_always_inline zend_mm_debug_info *zend_mm_get_debug_info(zend_mm_hea
14761476
ZEND_MM_CHECK(page_offset != 0, "zend_mm_heap corrupted");
14771477
chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE);
14781478
page_num = (int)(page_offset / ZEND_MM_PAGE_SIZE);
1479+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
14791480
info = chunk->map[page_num];
14801481
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
1482+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
14811483
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
14821484
int bin_num = ZEND_MM_SRUN_BIN_NUM(info);
14831485
return (zend_mm_debug_info*)((char*)ptr + bin_data_size[bin_num] - ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
@@ -1552,9 +1554,11 @@ static zend_always_inline void zend_mm_free_heap(zend_mm_heap *heap, void *ptr Z
15521554
} else {
15531555
zend_mm_chunk *chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE);
15541556
int page_num = (int)(page_offset / ZEND_MM_PAGE_SIZE);
1557+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
15551558
zend_mm_page_info info = chunk->map[page_num];
15561559

15571560
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
1561+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
15581562
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
15591563
zend_mm_free_small(heap, ptr, ZEND_MM_SRUN_BIN_NUM(info));
15601564
} else /* if (info & ZEND_MM_IS_LRUN) */ {
@@ -1583,8 +1587,10 @@ static size_t zend_mm_size(zend_mm_heap *heap, void *ptr ZEND_FILE_LINE_DC ZEND_
15831587

15841588
chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE);
15851589
page_num = (int)(page_offset / ZEND_MM_PAGE_SIZE);
1590+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
15861591
info = chunk->map[page_num];
15871592
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
1593+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
15881594
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
15891595
return bin_data_size[ZEND_MM_SRUN_BIN_NUM(info)];
15901596
} else /* if (info & ZEND_MM_IS_LARGE_RUN) */ {
@@ -2109,6 +2115,7 @@ static zend_mm_heap *zend_mm_init(void)
21092115
#endif
21102116
heap->huge_list = NULL;
21112117
heap->pid = getpid();
2118+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
21122119
return heap;
21132120
}
21142121

@@ -2139,6 +2146,8 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
21392146
p = heap->free_slot[i];
21402147
while (p != NULL) {
21412148
chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(p, ZEND_MM_CHUNK_SIZE);
2149+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2150+
21422151
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
21432152
page_offset = ZEND_MM_ALIGNED_OFFSET(p, ZEND_MM_CHUNK_SIZE);
21442153
ZEND_MM_ASSERT(page_offset != 0);
@@ -2157,6 +2166,8 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
21572166
has_free_pages = true;
21582167
}
21592168
chunk->map[page_num] = ZEND_MM_SRUN_EX(i, free_counter);
2169+
2170+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
21602171
p = zend_mm_get_next_free_slot(heap, i, p);
21612172
}
21622173

@@ -2168,6 +2179,8 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
21682179
p = q->next_free_slot;
21692180
while (p != NULL) {
21702181
chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(p, ZEND_MM_CHUNK_SIZE);
2182+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2183+
21712184
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
21722185
page_offset = ZEND_MM_ALIGNED_OFFSET(p, ZEND_MM_CHUNK_SIZE);
21732186
ZEND_MM_ASSERT(page_offset != 0);
@@ -2180,6 +2193,8 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
21802193
ZEND_MM_ASSERT(info & ZEND_MM_IS_SRUN);
21812194
ZEND_MM_ASSERT(!(info & ZEND_MM_IS_LRUN));
21822195
}
2196+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2197+
21832198
ZEND_MM_ASSERT(ZEND_MM_SRUN_BIN_NUM(info) == i);
21842199
if (ZEND_MM_SRUN_FREE_COUNTER(info) == bin_elements[i]) {
21852200
/* remove from cache */
@@ -2201,6 +2216,7 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
22012216
}
22022217

22032218
chunk = heap->main_chunk;
2219+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22042220
do {
22052221
i = ZEND_MM_FIRST_PAGE;
22062222
while (i < chunk->free_tail) {
@@ -2231,10 +2247,14 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
22312247

22322248
zend_mm_delete_chunk(heap, chunk);
22332249
chunk = next_chunk;
2250+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22342251
} else {
2252+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22352253
chunk = chunk->next;
2254+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22362255
}
22372256
} while (chunk != heap->main_chunk);
2257+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22382258

22392259
printf("Done running gc\n");
22402260
return collected * ZEND_MM_PAGE_SIZE;
@@ -2490,9 +2510,11 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
24902510
}
24912511

24922512
/* move all chunks except of the first one into the cache */
2513+
ZEND_ASAN_UNPOISON_MEMORY_REGION(heap->main_chunk, sizeof(zend_mm_chunk));
24932514
p = heap->main_chunk->next;
24942515
while (p != heap->main_chunk) {
24952516
zend_mm_chunk *q = p->next;
2517+
ZEND_ASAN_UNPOISON_MEMORY_REGION(q, sizeof(zend_mm_chunk));
24962518
p->next = heap->cached_chunks;
24972519
heap->cached_chunks = p;
24982520
p = q;
@@ -2504,6 +2526,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25042526
/* free all cached chunks */
25052527
while (heap->cached_chunks) {
25062528
p = heap->cached_chunks;
2529+
ZEND_ASAN_UNPOISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
25072530
heap->cached_chunks = p->next;
25082531
zend_mm_chunk_free(heap, p, ZEND_MM_CHUNK_SIZE);
25092532
}
@@ -2515,21 +2538,25 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25152538
while ((double)heap->cached_chunks_count + 0.9 > heap->avg_chunks_count &&
25162539
heap->cached_chunks) {
25172540
p = heap->cached_chunks;
2541+
ZEND_ASAN_UNPOISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
25182542
heap->cached_chunks = p->next;
25192543
zend_mm_chunk_free(heap, p, ZEND_MM_CHUNK_SIZE);
25202544
heap->cached_chunks_count--;
25212545
}
25222546
/* clear cached chunks */
25232547
p = heap->cached_chunks;
25242548
while (p != NULL) {
2549+
ZEND_ASAN_UNPOISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
25252550
zend_mm_chunk *q = p->next;
25262551
memset(p, 0, sizeof(zend_mm_chunk));
25272552
p->next = q;
2553+
ZEND_ASAN_POISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
25282554
p = q;
25292555
}
25302556

25312557
/* reinitialize the first chunk and heap */
25322558
p = heap->main_chunk;
2559+
ZEND_ASAN_UNPOISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
25332560
p->heap = &p->heap_slot;
25342561
p->next = p;
25352562
p->prev = p;
@@ -2563,6 +2590,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25632590
} else {
25642591
zend_mm_refresh_key(heap);
25652592
}
2593+
ZEND_ASAN_POISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
25662594
}
25672595
}
25682596

@@ -2673,14 +2701,21 @@ ZEND_API bool is_zend_ptr(const void *ptr)
26732701

26742702
if (AG(mm_heap)->main_chunk) {
26752703
zend_mm_chunk *chunk = AG(mm_heap)->main_chunk;
2704+
zend_mm_chunk *next;
2705+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
26762706

26772707
do {
26782708
if (ptr >= (void*)chunk
26792709
&& ptr < (void*)((char*)chunk + ZEND_MM_CHUNK_SIZE)) {
2710+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
26802711
return 1;
26812712
}
2682-
chunk = chunk->next;
2713+
next = chunk->next;
2714+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2715+
chunk = next;
2716+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
26832717
} while (chunk != AG(mm_heap)->main_chunk);
2718+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
26842719
}
26852720

26862721
zend_mm_huge_list *block = AG(mm_heap)->huge_list;
@@ -2755,10 +2790,12 @@ ZEND_API void* ZEND_FASTCALL _emalloc_huge(size_t size)
27552790
{ \
27562791
size_t page_offset = ZEND_MM_ALIGNED_OFFSET(ptr, ZEND_MM_CHUNK_SIZE); \
27572792
zend_mm_chunk *chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE); \
2758-
int page_num = page_offset / ZEND_MM_PAGE_SIZE; \
2793+
int page_num = page_offset / ZEND_MM_PAGE_SIZE; \chunk->
2794+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
27592795
ZEND_MM_CHECK(chunk->heap == AG(mm_heap), "zend_mm_heap corrupted"); \
27602796
ZEND_MM_ASSERT(chunk->map[page_num] & ZEND_MM_IS_SRUN); \
27612797
ZEND_MM_ASSERT(ZEND_MM_SRUN_BIN_NUM(chunk->map[page_num]) == _num); \
2798+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
27622799
zend_mm_free_small(AG(mm_heap), ptr, _num); \
27632800
} \
27642801
}
@@ -2772,7 +2809,9 @@ ZEND_API void* ZEND_FASTCALL _emalloc_huge(size_t size)
27722809
} \
27732810
{ \
27742811
zend_mm_chunk *chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE); \
2812+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
27752813
ZEND_MM_CHECK(chunk->heap == AG(mm_heap), "zend_mm_heap corrupted"); \
2814+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
27762815
zend_mm_free_small(AG(mm_heap), ptr, _num); \
27772816
} \
27782817
}
@@ -2788,10 +2827,13 @@ ZEND_API void ZEND_FASTCALL _efree_large(void *ptr, size_t size)
27882827
zend_mm_chunk *chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE);
27892828
int page_num = page_offset / ZEND_MM_PAGE_SIZE;
27902829
uint32_t pages_count = ZEND_MM_ALIGNED_SIZE_EX(size, ZEND_MM_PAGE_SIZE) / ZEND_MM_PAGE_SIZE;
2791-
2830+
2831+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
27922832
ZEND_MM_CHECK(chunk->heap == AG(mm_heap) && ZEND_MM_ALIGNED_OFFSET(page_offset, ZEND_MM_PAGE_SIZE) == 0, "zend_mm_heap corrupted");
27932833
ZEND_MM_ASSERT(chunk->map[page_num] & ZEND_MM_IS_LRUN);
27942834
ZEND_MM_ASSERT(ZEND_MM_LRUN_PAGES(chunk->map[page_num]) == pages_count);
2835+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2836+
27952837
zend_mm_free_large(AG(mm_heap), chunk, page_num, pages_count);
27962838
}
27972839
}
@@ -3296,6 +3338,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
32963338
#endif
32973339
return NULL;
32983340
}
3341+
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
32993342
heap = &chunk->heap_slot;
33003343
chunk->heap = heap;
33013344
chunk->next = chunk;
@@ -3347,6 +3390,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
33473390
}
33483391
heap->storage = storage;
33493392
heap->pid = getpid();
3393+
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
33503394
return heap;
33513395
#else
33523396
return NULL;

0 commit comments

Comments
 (0)