fiber: make madvise(2) arguments page aligned with ASAN slab cache
Regularly fiber stack slab is page aligned. So upper stack border is page aligned too when stack grows down. But with ASAN friendly slab cache implementation this border is not page aligned. As a result madvise call on stack may zero memory beyond stack slab which will cause heap corruption. In debug build corruption is detected by assertion: NO_WRAP > Fatal glibc error: malloc.c:2593 (sysmalloc): assertion failed: (old_top > == initial_top (av) && old_size == 0) || ((unsigned long) (old_size) >= > MINSIZE && prev_inuse (old_top) && ((unsigned long) old_end & (pagesize > - 1)) == 0) NO_WRAP Interestingly enough the issue can not be investigated using ASAN. The memory is zeroed by kernel code which is not instrumented so it is invisible for sanitizer. Looks like non-ASAN builds are not affected. Even if stack_size is not page aligned the slab allocated for stack is page aligned. Thus memory zeroing will be inside the slab and there will be no memory corruption. Also when stack grows up lower stack border in not aligned even with regular small implementation. So madvise call will fail with EINVAL as it is required that start address is page aligned. We ignore the error though. Let's fix this issue too while we at it. Let's introduce fiber_madvise_aligned to align madvise range with proper direction before calling madvise(2). To justify its usage note that besides fixing the issues described above, in case of stack growing down fiber->stack is page aligned and in case of stack growing up fiber->stack + fiber->stack_size is page aligned. Part of #7327 NO_TEST=tested by ASAN (debug build) NO_CHANGELOG=has effect only with newly introduced ASAN friendly slab cache NO_DOC=has effect only with newly introduced ASAN friendly slab cache (cherry picked from commit 130c7807)
Loading
Please register or sign in to comment