Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are two corner cases that are not handled properly and as a result, you can get
panic
inbd_init
.First minimal example:
In
bd_initfree
fork = 0
we will haveleft = 11
andright = 16
but we have only 16 blocks fork = 0
and maximum allowed index to access in arraybd_sizes[0].alloc
(in functionbd_initfree_pair
) is 15. Therefore we have index out of range (but we will never find it with AddressSanitizer) and we will just push the last block to list and calculate wrongly free space.Second example:
For
k = 1
we will have 8 blocks at size 32 bytes, but the first 6 blocks and the last one will be marked asalloc
. In functionbd_initfree
we will haveleft = 6
andright = 7
as a result we will add sixth block to the free list twice and calculate wrongly free space.