Skip to content

Commit bc8ac16

Browse files
committed
Panic if free_blocks_count is invalid in malloc()
In malloc(), free_blocks_count was decremented only if it was greater than zero. However, once a usable block has been found, free_blocks_count should never be zero. If this condition occurs, it indicates a fatal inconsistency in allocator state. Replace the conditional decrement with a check that panics with ERR_HEAP_CORRUPT when free_blocks_count <= 0, ensuring the kernel halts on heap accounting corruption.
1 parent 64eb9cb commit bc8ac16

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

lib/malloc.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,8 +177,11 @@ void *malloc(uint32_t size)
177177
}
178178

179179
MARK_USED(p);
180-
if (free_blocks_count > 0)
181-
free_blocks_count--;
180+
if (unlikely(free_blocks_count <= 0)) {
181+
panic(ERR_HEAP_CORRUPT);
182+
return NULL;
183+
}
184+
free_blocks_count--;
182185

183186
CRITICAL_LEAVE();
184187
return (void *) (p + 1);

0 commit comments

Comments
 (0)