smalloc: don't crash on being passed a bad pointer
[fio.git] / smalloc.c
index 7b30ce704601894c255a2c5b34dc56a547a45dc1..447d5c55fe3336986c490c068a5f919a100b55cf 100644 (file)
--- a/smalloc.c
+++ b/smalloc.c
 #include <assert.h>
 #include <string.h>
 #include <unistd.h>
+#include <inttypes.h>
 #include <sys/types.h>
 #include <limits.h>
+#include <fcntl.h>
 
 #include "mutex.h"
+#include "arch/arch.h"
+#include "os/os.h"
+#include "smalloc.h"
+#include "log.h"
 
-#define MP_SAFE                        /* define to made allocator thread safe */
+#define SMALLOC_REDZONE                /* define to detect memory corruption */
 
-#define INITIAL_SIZE   32*1048576      /* new pool size */
-#define MAX_POOLS      4               /* maximum number of pools to setup */
+#define SMALLOC_BPB    32      /* block size, bytes-per-bit in bitmap */
+#define SMALLOC_BPI    (sizeof(unsigned int) * 8)
+#define SMALLOC_BPL    (SMALLOC_BPB * SMALLOC_BPI)
+
+#define INITIAL_SIZE   16*1024*1024    /* new pool size */
+#define MAX_POOLS      8               /* maximum number of pools to setup */
+
+#define SMALLOC_PRE_RED                0xdeadbeefU
+#define SMALLOC_POST_RED       0x5aa55aa5U
 
 unsigned int smalloc_pool_size = INITIAL_SIZE;
+static const int int_mask = sizeof(int) - 1;
 
 struct pool {
        struct fio_mutex *lock;                 /* protects this pool */
        void *map;                              /* map of blocks */
-       void *last;                             /* next free block hint */
-       unsigned int size;                      /* size of pool */
-       unsigned int room;                      /* size left in pool */
-       unsigned int largest_block;             /* largest block free */
-       unsigned int free_since_compact;        /* sfree() since compact() */
-       int fd;                                 /* memory backing fd */
-       char file[PATH_MAX];                    /* filename for fd */
+       unsigned int *bitmap;                   /* blocks free/busy map */
+       size_t free_blocks;             /* free blocks */
+       size_t nr_blocks;                       /* total blocks */
+       size_t next_non_full;
+       size_t mmap_size;
+};
+
+struct block_hdr {
+       size_t size;
+#ifdef SMALLOC_REDZONE
+       unsigned int prered;
+#endif
 };
 
 static struct pool mp[MAX_POOLS];
 static unsigned int nr_pools;
 static unsigned int last_pool;
-static struct fio_mutex *lock;
-
-struct mem_hdr {
-       unsigned int size;
-};
+static struct fio_rwlock *lock;
 
 static inline void pool_lock(struct pool *pool)
 {
-       if (pool->lock)
-               fio_mutex_down(pool->lock);
+       fio_mutex_down(pool->lock);
 }
 
 static inline void pool_unlock(struct pool *pool)
 {
-       if (pool->lock)
-               fio_mutex_up(pool->lock);
+       fio_mutex_up(pool->lock);
 }
 
 static inline void global_read_lock(void)
 {
-       if (lock)
-               fio_mutex_down_read(lock);
+       fio_rwlock_read(lock);
 }
 
 static inline void global_read_unlock(void)
 {
-       if (lock)
-               fio_mutex_up_read(lock);
+       fio_rwlock_unlock(lock);
 }
 
 static inline void global_write_lock(void)
 {
-       if (lock)
-               fio_mutex_down_write(lock);
+       fio_rwlock_write(lock);
 }
 
 static inline void global_write_unlock(void)
 {
-       if (lock)
-               fio_mutex_up_write(lock);
+       fio_rwlock_unlock(lock);
 }
 
-#define hdr_free(hdr)          ((hdr)->size & 0x80000000)
-#define hdr_size(hdr)          ((hdr)->size & ~0x80000000)
-#define hdr_mark_free(hdr)     ((hdr)->size |= 0x80000000)
-
 static inline int ptr_valid(struct pool *pool, void *ptr)
 {
-       return (ptr >= pool->map) && (ptr < pool->map + pool->size);
-}
+       unsigned int pool_size = pool->nr_blocks * SMALLOC_BPL;
 
-static inline int __hdr_valid(struct pool *pool, struct mem_hdr *hdr,
-                             unsigned int size)
-{
-       return ptr_valid(pool, hdr) && ptr_valid(pool, (void *) hdr + size - 1);
+       return (ptr >= pool->map) && (ptr < pool->map + pool_size);
 }
 
-static inline int hdr_valid(struct pool *pool, struct mem_hdr *hdr)
+static inline size_t size_to_blocks(size_t size)
 {
-       return __hdr_valid(pool, hdr, hdr_size(hdr));
+       return (size + SMALLOC_BPB - 1) / SMALLOC_BPB;
 }
 
-static inline int region_free(struct mem_hdr *hdr)
+static int blocks_iter(struct pool *pool, unsigned int pool_idx,
+                      unsigned int idx, size_t nr_blocks,
+                      int (*func)(unsigned int *map, unsigned int mask))
 {
-       return hdr_free(hdr) || (!hdr_free(hdr) && !hdr_size(hdr));
-}
 
-static inline struct mem_hdr *__hdr_nxt(struct pool *pool, struct mem_hdr *hdr,
-                                       unsigned int size)
-{
-       struct mem_hdr *nxt = (void *) hdr + size + sizeof(*hdr);
+       while (nr_blocks) {
+               unsigned int this_blocks, mask;
+               unsigned int *map;
 
-       if (__hdr_valid(pool, nxt, size))
-               return nxt;
+               if (pool_idx >= pool->nr_blocks)
+                       return 0;
 
-       return NULL;
-}
+               map = &pool->bitmap[pool_idx];
 
-static inline struct mem_hdr *hdr_nxt(struct pool *pool, struct mem_hdr *hdr)
-{
-       return __hdr_nxt(pool, hdr, hdr_size(hdr));
-}
+               this_blocks = nr_blocks;
+               if (this_blocks + idx > SMALLOC_BPI) {
+                       this_blocks = SMALLOC_BPI - idx;
+                       idx = SMALLOC_BPI - this_blocks;
+               }
 
-static void merge(struct pool *pool, struct mem_hdr *hdr, struct mem_hdr *nxt)
-{
-       unsigned int hfree = hdr_free(hdr);
-       unsigned int nfree = hdr_free(nxt);
+               if (this_blocks == SMALLOC_BPI)
+                       mask = -1U;
+               else
+                       mask = ((1U << this_blocks) - 1) << idx;
 
-       hdr->size = hdr_size(hdr) + hdr_size(nxt) + sizeof(*nxt);
-       nxt->size = 0;
+               if (!func(map, mask))
+                       return 0;
 
-       if (hfree)
-               hdr_mark_free(hdr);
-       if (nfree)
-               hdr_mark_free(nxt);
+               nr_blocks -= this_blocks;
+               idx = 0;
+               pool_idx++;
+       }
 
-       if (pool->last == nxt)
-               pool->last = hdr;
+       return 1;
 }
 
-static int combine(struct pool *pool, struct mem_hdr *prv, struct mem_hdr *hdr)
+static int mask_cmp(unsigned int *map, unsigned int mask)
 {
-       if (prv && hdr_free(prv) && hdr_free(hdr)) {
-               merge(pool, prv, hdr);
-               return 1;
-       }
+       return !(*map & mask);
+}
 
-       return 0;
+static int mask_clear(unsigned int *map, unsigned int mask)
+{
+       assert((*map & mask) == mask);
+       *map &= ~mask;
+       return 1;
 }
 
-static int compact_pool(struct pool *pool)
+static int mask_set(unsigned int *map, unsigned int mask)
 {
-       struct mem_hdr *hdr = pool->map, *nxt;
-       unsigned int compacted = 0;
+       assert(!(*map & mask));
+       *map |= mask;
+       return 1;
+}
 
-       if (pool->free_since_compact < 50)
-               return 1;
+static int blocks_free(struct pool *pool, unsigned int pool_idx,
+                      unsigned int idx, size_t nr_blocks)
+{
+       return blocks_iter(pool, pool_idx, idx, nr_blocks, mask_cmp);
+}
 
-       while (hdr) {
-               nxt = hdr_nxt(pool, hdr);
-               if (!nxt)
-                       break;
-               if (hdr_free(nxt) && hdr_free(hdr)) {
-                       merge(pool, hdr, nxt);
-                       compacted++;
-                       continue;
-               }
-               hdr = hdr_nxt(pool, hdr);
-       }
+static void set_blocks(struct pool *pool, unsigned int pool_idx,
+                      unsigned int idx, size_t nr_blocks)
+{
+       blocks_iter(pool, pool_idx, idx, nr_blocks, mask_set);
+}
 
-       pool->free_since_compact = 0;
-       return !!compacted;
+static void clear_blocks(struct pool *pool, unsigned int pool_idx,
+                        unsigned int idx, size_t nr_blocks)
+{
+       blocks_iter(pool, pool_idx, idx, nr_blocks, mask_clear);
+}
+
+static int find_next_zero(int word, int start)
+{
+       assert(word != -1U);
+       word >>= start;
+       return ffz(word) + start;
 }
 
 static int add_pool(struct pool *pool, unsigned int alloc_size)
 {
-       struct mem_hdr *hdr;
+       int bitmap_blocks;
+       int mmap_flags;
        void *ptr;
-       int fd;
 
-       strcpy(pool->file, "/tmp/.fio_smalloc.XXXXXX");
-       fd = mkstemp(pool->file);
-       if (fd < 0)
-               goto out_close;
-
-       alloc_size += sizeof(*hdr);
-       if (alloc_size > smalloc_pool_size)
-               pool->size = alloc_size;
-       else
-               pool->size = smalloc_pool_size;
-
-       if (ftruncate(fd, pool->size) < 0)
-               goto out_unlink;
+#ifdef SMALLOC_REDZONE
+       alloc_size += sizeof(unsigned int);
+#endif
+       alloc_size += sizeof(struct block_hdr);
+       if (alloc_size < INITIAL_SIZE)
+               alloc_size = INITIAL_SIZE;
+
+       /* round up to nearest full number of blocks */
+       alloc_size = (alloc_size + SMALLOC_BPL - 1) & ~(SMALLOC_BPL - 1);
+       bitmap_blocks = alloc_size / SMALLOC_BPL;
+       alloc_size += bitmap_blocks * sizeof(unsigned int);
+       pool->mmap_size = alloc_size;
+
+       pool->nr_blocks = bitmap_blocks;
+       pool->free_blocks = bitmap_blocks * SMALLOC_BPB;
+
+       mmap_flags = OS_MAP_ANON;
+#ifdef CONFIG_ESX
+       mmap_flags |= MAP_PRIVATE;
+#else
+       mmap_flags |= MAP_SHARED;
+#endif
+       ptr = mmap(NULL, alloc_size, PROT_READ|PROT_WRITE, mmap_flags, -1, 0);
 
-       ptr = mmap(NULL, pool->size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
        if (ptr == MAP_FAILED)
-               goto out_unlink;
+               goto out_fail;
 
-       memset(ptr, 0, pool->size);
-       pool->map = pool->last = ptr;
+       memset(ptr, 0, alloc_size);
+       pool->map = ptr;
+       pool->bitmap = (void *) ptr + (pool->nr_blocks * SMALLOC_BPL);
 
-#ifdef MP_SAFE
-       pool->lock = fio_mutex_init(1);
+       pool->lock = fio_mutex_init(FIO_MUTEX_UNLOCKED);
        if (!pool->lock)
-               goto out_unlink;
-#endif
+               goto out_fail;
 
-       pool->fd = fd;
-
-       hdr = pool->map;
-       pool->room = hdr->size = pool->size - sizeof(*hdr);
-       pool->largest_block = pool->room;
-       hdr_mark_free(hdr);
-       global_write_lock();
        nr_pools++;
-       global_write_unlock();
        return 0;
-out_unlink:
+out_fail:
+       log_err("smalloc: failed adding pool\n");
        if (pool->map)
-               munmap(pool->map, pool->size);
-       unlink(pool->file);
-out_close:
-       if (fd >= 0)
-               close(fd);
+               munmap(pool->map, pool->mmap_size);
        return 1;
 }
 
 void sinit(void)
 {
-       int ret;
+       int i, ret;
 
-#ifdef MP_SAFE
-       lock = fio_mutex_rw_init();
-#endif
-       ret = add_pool(&mp[0], INITIAL_SIZE);
-       assert(!ret);
+       lock = fio_rwlock_init();
+
+       for (i = 0; i < MAX_POOLS; i++) {
+               ret = add_pool(&mp[i], INITIAL_SIZE);
+               if (ret)
+                       break;
+       }
+
+       /*
+        * If we added at least one pool, we should be OK for most
+        * cases.
+        */
+       assert(i);
 }
 
 static void cleanup_pool(struct pool *pool)
 {
-       unlink(pool->file);
-       close(pool->fd);
-       munmap(pool->map, pool->size);
+       /*
+        * This will also remove the temporary file we used as a backing
+        * store, it was already unlinked
+        */
+       munmap(pool->map, pool->mmap_size);
 
        if (pool->lock)
                fio_mutex_remove(pool->lock);
@@ -251,32 +267,80 @@ void scleanup(void)
                cleanup_pool(&mp[i]);
 
        if (lock)
-               fio_mutex_remove(lock);
+               fio_rwlock_remove(lock);
+}
+
+#ifdef SMALLOC_REDZONE
+static void *postred_ptr(struct block_hdr *hdr)
+{
+       uintptr_t ptr;
+
+       ptr = (uintptr_t) hdr + hdr->size - sizeof(unsigned int);
+       ptr = (ptr + int_mask) & ~int_mask;
+
+       return (void *) ptr;
+}
+
+static void fill_redzone(struct block_hdr *hdr)
+{
+       unsigned int *postred = postred_ptr(hdr);
+
+       hdr->prered = SMALLOC_PRE_RED;
+       *postred = SMALLOC_POST_RED;
+}
+
+static void sfree_check_redzone(struct block_hdr *hdr)
+{
+       unsigned int *postred = postred_ptr(hdr);
+
+       if (hdr->prered != SMALLOC_PRE_RED) {
+               log_err("smalloc pre redzone destroyed!\n"
+                       " ptr=%p, prered=%x, expected %x\n",
+                               hdr, hdr->prered, SMALLOC_PRE_RED);
+               assert(0);
+       }
+       if (*postred != SMALLOC_POST_RED) {
+               log_err("smalloc post redzone destroyed!\n"
+                       "  ptr=%p, postred=%x, expected %x\n",
+                               hdr, *postred, SMALLOC_POST_RED);
+               assert(0);
+       }
+}
+#else
+static void fill_redzone(struct block_hdr *hdr)
+{
+}
+
+static void sfree_check_redzone(struct block_hdr *hdr)
+{
 }
+#endif
 
 static void sfree_pool(struct pool *pool, void *ptr)
 {
-       struct mem_hdr *hdr, *nxt;
+       struct block_hdr *hdr;
+       unsigned int i, idx;
+       unsigned long offset;
 
        if (!ptr)
                return;
 
-       assert(ptr_valid(pool, ptr));
+       ptr -= sizeof(*hdr);
+       hdr = ptr;
 
-       pool_lock(pool);
-       hdr = ptr - sizeof(*hdr);
-       assert(!hdr_free(hdr));
-       hdr_mark_free(hdr);
-       pool->room -= hdr_size(hdr);
+       assert(ptr_valid(pool, ptr));
 
-       nxt = hdr_nxt(pool, hdr);
-       if (nxt && hdr_free(nxt))
-               merge(pool, hdr, nxt);
+       sfree_check_redzone(hdr);
 
-       if (hdr_size(hdr) > pool->largest_block)
-               pool->largest_block = hdr_size(hdr);
+       offset = ptr - pool->map;
+       i = offset / SMALLOC_BPL;
+       idx = (offset % SMALLOC_BPL) / SMALLOC_BPB;
 
-       pool->free_since_compact++;
+       pool_lock(pool);
+       clear_blocks(pool, i, idx, size_to_blocks(hdr->size));
+       if (i < pool->next_non_full)
+               pool->next_non_full = i;
+       pool->free_blocks += size_to_blocks(hdr->size);
        pool_unlock(pool);
 }
 
@@ -299,130 +363,148 @@ void sfree(void *ptr)
 
        global_read_unlock();
 
-       assert(pool);
-       sfree_pool(pool, ptr);
+       if (pool) {
+               sfree_pool(pool, ptr);
+               return;
+       }
+
+       log_err("smalloc: ptr %p not from smalloc pool\n", ptr);
 }
 
-static void *smalloc_pool(struct pool *pool, unsigned int size)
+static void *__smalloc_pool(struct pool *pool, size_t size)
 {
-       struct mem_hdr *hdr, *prv;
-       int did_restart = 0;
-       void *ret;
-
-       if (!size)
-               return NULL;
+       size_t nr_blocks;
+       unsigned int i;
+       unsigned int offset;
+       unsigned int last_idx;
+       void *ret = NULL;
 
        pool_lock(pool);
-       if (size > pool->room + sizeof(*hdr))
-               goto fail;
-       if ((size > pool->largest_block) && pool->largest_block)
-               goto fail;
-restart:
-       hdr = pool->last;
-       prv = NULL;
-       do {
-               if (combine(pool, prv, hdr))
-                       hdr = prv;
 
-               if (hdr_free(hdr) && hdr_size(hdr) >= size)
-                       break;
+       nr_blocks = size_to_blocks(size);
+       if (nr_blocks > pool->free_blocks)
+               goto fail;
 
-               prv = hdr;
-       } while ((hdr = hdr_nxt(pool, hdr)) != NULL);
+       i = pool->next_non_full;
+       last_idx = 0;
+       offset = -1U;
+       while (i < pool->nr_blocks) {
+               unsigned int idx;
 
-       if (!hdr)
-               goto fail;
+               if (pool->bitmap[i] == -1U) {
+                       i++;
+                       pool->next_non_full = i;
+                       last_idx = 0;
+                       continue;
+               }
 
-       /*
-        * more room, adjust next header if any
-        */
-       if (hdr_size(hdr) - size >= 2 * sizeof(*hdr)) {
-               struct mem_hdr *nxt = __hdr_nxt(pool, hdr, size);
-
-               if (nxt) {
-                       nxt->size = hdr_size(hdr) - size - sizeof(*hdr);
-                       if (hdr_size(hdr) == pool->largest_block)
-                               pool->largest_block = hdr_size(nxt);
-                       hdr_mark_free(nxt);
-               } else
-                       size = hdr_size(hdr);
-       } else
-               size = hdr_size(hdr);
-
-       if (size == hdr_size(hdr) && size == pool->largest_block)
-               pool->largest_block = 0;
+               idx = find_next_zero(pool->bitmap[i], last_idx);
+               if (!blocks_free(pool, i, idx, nr_blocks)) {
+                       idx += nr_blocks;
+                       if (idx < SMALLOC_BPI)
+                               last_idx = idx;
+                       else {
+                               last_idx = 0;
+                               while (idx >= SMALLOC_BPI) {
+                                       i++;
+                                       idx -= SMALLOC_BPI;
+                               }
+                       }
+                       continue;
+               }
+               set_blocks(pool, i, idx, nr_blocks);
+               offset = i * SMALLOC_BPL + idx * SMALLOC_BPB;
+               break;
+       }
 
-       /*
-        * also clears free bit
-        */
-       hdr->size = size;
-       pool->last = hdr_nxt(pool, hdr);
-       if (!pool->last)
-               pool->last = pool->map;
-       pool->room -= size;
+       if (i < pool->nr_blocks) {
+               pool->free_blocks -= nr_blocks;
+               ret = pool->map + offset;
+       }
+fail:
        pool_unlock(pool);
-
-       ret = (void *) hdr + sizeof(*hdr);
-       memset(ret, 0, size);
        return ret;
-fail:
+}
+
+static void *smalloc_pool(struct pool *pool, size_t size)
+{
+       size_t alloc_size = size + sizeof(struct block_hdr);
+       void *ptr;
+
        /*
-        * if we fail to allocate, first compact the entries that we missed.
-        * if that also fails, increase the size of the pool
+        * Round to int alignment, so that the postred pointer will
+        * be naturally aligned as well.
         */
-       if (++did_restart <= 1) {
-               if (!compact_pool(pool)) {
-                       pool->last = pool->map;
-                       goto restart;
-               }
+#ifdef SMALLOC_REDZONE
+       alloc_size += sizeof(unsigned int);
+       alloc_size = (alloc_size + int_mask) & ~int_mask;
+#endif
+
+       ptr = __smalloc_pool(pool, alloc_size);
+       if (ptr) {
+               struct block_hdr *hdr = ptr;
+
+               hdr->size = alloc_size;
+               fill_redzone(hdr);
+
+               ptr += sizeof(*hdr);
+               memset(ptr, 0, size);
        }
-       pool_unlock(pool);
-       return NULL;
+
+       return ptr;
 }
 
-void *smalloc(unsigned int size)
+void *smalloc(size_t size)
 {
-       unsigned int i;
+       unsigned int i, end_pool;
 
-       global_read_lock();
+       if (size != (unsigned int) size)
+               return NULL;
+
+       global_write_lock();
        i = last_pool;
+       end_pool = nr_pools;
 
        do {
-               for (; i < nr_pools; i++) {
+               for (; i < end_pool; i++) {
                        void *ptr = smalloc_pool(&mp[i], size);
 
                        if (ptr) {
                                last_pool = i;
-                               global_read_unlock();
+                               global_write_unlock();
                                return ptr;
                        }
                }
                if (last_pool) {
-                       last_pool = 0;
+                       end_pool = last_pool;
+                       last_pool = i = 0;
                        continue;
                }
 
-               if (nr_pools + 1 >= MAX_POOLS)
-                       break;
-               else {
-                       i = nr_pools;
-                       global_read_unlock();
-                       if (add_pool(&mp[nr_pools], size))
-                               goto out;
-                       global_read_lock();
-               }
+               break;
        } while (1);
 
-       global_read_unlock();
-out:
+       global_write_unlock();
        return NULL;
 }
 
+void *scalloc(size_t nmemb, size_t size)
+{
+       void *ret;
+
+       ret = smalloc(nmemb * size);
+       if (ret)
+               memset(ret, 0, nmemb * size);
+
+       return ret;
+}
+
 char *smalloc_strdup(const char *str)
 {
-       char *ptr;
+       char *ptr = NULL;
 
        ptr = smalloc(strlen(str) + 1);
-       strcpy(ptr, str);
+       if (ptr)
+               strcpy(ptr, str);
        return ptr;
 }