[Bug malloc/22408] New: mallinfo access top arena heap without arena lock

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=22408

            Bug ID: 22408
           Summary: mallinfo access top arena heap without arena lock
           Product: glibc
           Version: 2.26
            Status: NEW
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

Downstream bug report from jcfinger@pobox.com:

Description of problem:
Race condition in malloc_info can result SIGSEGV.

How reproducible:
Be unlucky enough to free enough memory that an arena is released while a
different thread is doing malloc_info.  Time it right and you lose.

Actual results:
SIGSEGV, core

Expected results:
accurate results back from malloc_info

Additional info:
>From looking at the code, the "mi_arena" function nested inside of malloc_info
calls 'mutex_unlock (&ar_ptr->mutex);' but then several lines down starts
looking in arenas again.  My particular core file died on line

        fprintf (fp,
                 "<aspace type=\"total\" size=\"%zu\"/>\n"
                 "<aspace type=\"mprotect\" size=\"%zu\"/>\n",
                 heap->size, heap->mprotect_size);

The *ar_ptr looked good.  But *heap was not in accessible memory.  "info file"
showed that the memory was no longer mapped.  But 0x8000000 beyond its address
still existed.

I don't grok the malloc code, but it seems that maybe the mutex shouldn't have
been released yet.

-- 
You are receiving this mail because:
You are on the CC list for the bug.