Age | Commit message (Collapse) | Author | Files | Lines |
|
This ensures that the sibling list of a pointer doesn't become invalid
during a free operation. It is an alternative fix to the fix in
6f51a1f45bf4de062cce7a562477e8140630a53d, and avoids the problem of
trying to calculate the parent pointer early
This should fix the subtle spoolss talloc bug that Simo found
Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Tue Aug 9 01:53:17 CEST 2011 on sn-devel-104
|
|
Otherwise tc->name will end up pointing to garbage when it is not
set to a const but rather to a string allocate as child of the context itself.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
|
|
metze
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue May 17 10:49:13 CEST 2011 on sn-devel-104
|
|
This is similar to commit 6f51a1f45bf4de062cce7a562477e8140630a53d.
metze
|
|
metze
|
|
metze
|
|
*talloc_pool_objectcount(pool_tc) == 2 doesn't mean the one of the objects
is the pool itself! So we better check for == 1 and calculate the chunk count.
metze
|
|
This should follow the same logic...
metze
|
|
The optimization of the object_count == 1 case should only happen
for when we're not destroying the pool itself. And it should only
happen if the pool itself is still valid.
If the pool isn't valid (it has TALLOC_FLAG_FREE),
object_count == 1 does not mean that the pool is the last object,
which can happen if you use talloc_steal/move() on memory
from the pool and then free the pool itself.
Thanks to Volker for noticing this!
metze
|
|
TC_INVALIDATE_SHRINK_CHUNK() for realloc path
If we optimize on top of raw realloc() we need
TC_INVALIDATE_SHRINK_CHUNK together with TC_UNDEFINE_GROW_CHUNK
(with was missing and caused false positive valgrind warnings).
But that is really slow, as we do a lot of talloc_realloc calls in samba.
That's why we only to TC_UNDEFINE_SHRINK_CHUNK() for now.
metze
|
|
metze
Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Apr 13 14:33:23 CEST 2011 on sn-devel-104
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
This invalidates the unused bytes if we shrink memory.
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
This makes it easier to mark a talloc pointer as
invalid.
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
As this includes the padding to 16 bytes.
metze
Signed-off-By: Andrew Tridgell <tridge@samba.org>
|
|
this is the minimal fix for the problem Rusty found. I previously
thought that the best fix would be to change tc->parent to be valid
for all pointers, but that is expensive for realloc with large numbers
of child pointers, which is much more commmon than I expected it to
be.
Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Wed Jan 5 07:22:27 CET 2011 on sn-devel-104
|
|
|
|
when this environment variable is set, talloc will fill freed memory
with the value from that environment variable. This can be used to
help find use after free bugs when valgrind is too slow to be used
|
|
|
|
|
|
when a ptr has a single reference and a NULL parent, then
talloc_free(ptr) is not ambiguous, as the caller could not have done a
talloc_free(NULL) to free the memory
Pair-Programmed-With: Rusty Russell <rusty@samba.org>
|
|
|
|
this is useful when tracking down talloc loops. It is probably too
expensive to have on by default.
|
|
Thanks to the suggestion from simo
|
|
We have a bug in the dcerpc registry code that can cause a talloc loop
that chews unlimited CPU because of talloc_is_parent() during a
talloc_free()
|
|
If ALWASY_REALLOC is defined and we are to 'shrink' memory block,
memcpy() will write outside memory just allocated.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
|
|
When we disable null tracking, we need to move any existing objects
that are under the null_context to be parented by the true NULL
context.
We also need a new talloc_enable_null_tracking_no_autofree() function,
as the talloc testsuite cannot cope with the moving of the autofree
context under the null_context as it wants to check exact counts of
objects under the null_context, and smbtorture has a large number of
objects in the autofree_context from .init functions
|
|
It's annoying when you use
p talloc_report_full(ctx, fopen("/tmp/xx","w"))
in gdb, and if you don't have write permission on the file then
you get a segv.
|
|
If NULL tracking is enabled after the autofree context is initialised
then autofree ends up separate from the null_context. This means that
talloc_report_full() doesn't report the autofree context. Fix this by
reparenting the autofree context when we create the null_context.
|
|
When we get a double free abort from talloc it is often hard to work
out where the first free came from. This patch takes advantage of the
fact that _talloc_free() now takes a location the free was called from
to allow the double free abort code to print the location of the first
free that conflicts.
|
|
We also use the major and minor versions in the TALLOC_MAGIC,
so that we can detect if two conflicting versions of talloc
are loaded in one process. In this case we use talloc_log() to
output a very useful debug message before we call
talloc_abort().
metze
|
|
metze
|
|
metze
|
|
So that the application can setup a log function to get ERROR
and WARNING messages.
metze
|
|
We have to many callers, which rely on that talloc_steal() never fails.
metze
|
|
not exit
This will be useful in the testsuite,
where we could check if an abort would happen.
metze
|
|
metze
|
|
null_context
metze
|
|
|
|
|
|
metze
|
|
|
|
These changes follow from the discussions on samba-technical. The
changes are in several parts, and stem from the inherent ambiguity
that was in talloc_free() and talloc_steal() when the pointer that is
being changes has more than one parent, via references.
The changes are:
1) when you call talloc_free() on a pointer with more than one parent
the free will fail, and talloc will log an error to stderr like this:
ERROR: talloc_free with references at some/foo.c:123
reference at other/bar.c:201
reference at other/foobar.c:641
2) Similarly, when you call talloc_steal() on a pointer with more
than one parent, the steal will fail and talloc will log an error to
stderr like this:
ERROR: talloc_steal with references at some/foo.c:123
reference at other/bar.c:201
3) A new function talloc_reparent() has been added to change a parent
in a controlled fashion. You need to supply both the old parent and
the new parent. It handles the case whether either the old parent was
a normal parent or a reference
The use of stderr in the logging is ugly (and potentially dangerous),
and will be removed in a future patch. We'll need to add a debug
registration function to talloc.
|