microsoft / microsoft/mimalloc

dev3: mimalloc touches uncommitted memory in very rare cases

Open
#1,098 17 comments 1 reaction 0 assignees View on GitHub
Dominant language
C
Stars
13.4k
Forks
1.2k
Avg merge
4d 45m
Merged PRs (30d)
13

Description

Hi Daan! Thanks for quickly addressing the issue with touching uncommitted memory, it greatly helped!
However, I'm still observing very rare crash in mimalloc with the same symptoms: mimalloc tried to write to address that is `MEM_RESERVE`, but not `MEM_COMMIT`...

It happens with such callstack:
```
_mi_memset(void *,int,unsigned __int64)
‎internal.h:1102
_mi_memzero(void *,unsigned __int64)
‎internal.h:1150
mi_arenas_page_alloc_fresh(unsigned __int64,unsigned __int64,unsigned __int64,mi_arena_s *,int,bool,mi_tld_s *)
‎arena.c:682
mi_arenas_page_singleton_alloc(mi_heap_s *,unsigned __int64,unsigned __int64)
‎arena.c:757
mi_page_fresh_alloc(mi_heap_s *,mi_page_queue_s *,unsigned __int64,unsigned __int64)
‎page.c:305
mi_huge_page_alloc(mi_heap_s *,unsigned __int64,unsigned __int64,mi_page_queue_s *)
‎page.c:897
mi_find_page(mi_heap_s *,unsigned __int64,unsigned __int64)
‎page.c:925
_mi_malloc_generic(mi_heap_s *,unsigned __int64,bool,unsigned __int64)
‎page.c:968
_mi_heap_realloc_zero(mi_heap_s *,void *,unsigned __int64,bool)
```
And I suspect something is off with this code:
```
// claimed free slices: initialize the page partly
if (!memid.initially_zero && memid.initially_committed) {
mi_track_mem_undefined(page, slice_count * MI_ARENA_SLICE_SIZE);
_mi_memzero_aligned(page, sizeof(*page));
}
```
Maybe `initially_committed` was set to true mistakenly?...
Could you take a look, please?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with arena.c around lines 682 and 757, then trace the reported allocation path through page.c and the _mi_memzero_aligned call in internal.h. Check how initially_committed is determined for this path and verify that _mi_memzero does not write to MEM_RESERVE memory; done means the rare allocation no longer produces the reported invalid write.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.