microsoft / microsoft/mimalloc
dev3: mimalloc touches uncommitted memory in very rare cases
- Dominant language
- C
- Stars
- 13.4k
- Forks
- 1.2k
- Avg merge
- 4d 45m
- Merged PRs (30d)
- 13
Description
Hi Daan! Thanks for quickly addressing the issue with touching uncommitted memory, it greatly helped!
However, I'm still observing very rare crash in mimalloc with the same symptoms: mimalloc tried to write to address that is `MEM_RESERVE`, but not `MEM_COMMIT`...
It happens with such callstack:
```
_mi_memset(void *,int,unsigned __int64)
internal.h:1102
_mi_memzero(void *,unsigned __int64)
internal.h:1150
mi_arenas_page_alloc_fresh(unsigned __int64,unsigned __int64,unsigned __int64,mi_arena_s *,int,bool,mi_tld_s *)
arena.c:682
mi_arenas_page_singleton_alloc(mi_heap_s *,unsigned __int64,unsigned __int64)
arena.c:757
mi_page_fresh_alloc(mi_heap_s *,mi_page_queue_s *,unsigned __int64,unsigned __int64)
page.c:305
mi_huge_page_alloc(mi_heap_s *,unsigned __int64,unsigned __int64,mi_page_queue_s *)
page.c:897
mi_find_page(mi_heap_s *,unsigned __int64,unsigned __int64)
page.c:925
_mi_malloc_generic(mi_heap_s *,unsigned __int64,bool,unsigned __int64)
page.c:968
_mi_heap_realloc_zero(mi_heap_s *,void *,unsigned __int64,bool)
```
And I suspect something is off with this code:
```
// claimed free slices: initialize the page partly
if (!memid.initially_zero && memid.initially_committed) {
mi_track_mem_undefined(page, slice_count * MI_ARENA_SLICE_SIZE);
_mi_memzero_aligned(page, sizeof(*page));
}
```
Maybe `initially_committed` was set to true mistakenly?...
Could you take a look, please?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with arena.c around lines 682 and 757, then trace the reported allocation path through page.c and the _mi_memzero_aligned call in internal.h. Check how initially_committed is determined for this path and verify that _mi_memzero does not write to MEM_RESERVE memory; done means the rare allocation no longer produces the reported invalid write.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100