summaryrefslogtreecommitdiffstats
path: root/src/basic/alloc-util.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* memory-util: add a concept for gcc cleanup attribute based array destructionLennart Poettering2023-02-231-0/+1
|
* alloc-util: Disallow inlining of expand_to_usableSiddhesh Poyarekar2023-01-081-3/+4
| | | | | Explicitly set __attribute__ ((noinline)) so that the compiler does not attempt to inline expand_to_usable, even with LTO.
* Use dummy allocator to make accesses defined as per standardSiddhesh Poyarekar2022-12-141-10/+28
| | | | | | | | | | | | | | | | | | | | | | systemd uses malloc_usable_size() everywhere to use memory blocks obtained through malloc, but that is abuse since the malloc_usable_size() interface isn't meant for this kind of use, it is for diagnostics only. This is also why systemd behaviour is flaky when built with _FORTIFY_SOURCE. One way to make this more standard (and hence safer) is to, at every malloc_usable_size() call, also 'reallocate' the block so that the compiler can see the larger size. This is done through a dummy reallocator whose only purpose is to tell the compiler about the larger usable size, it doesn't do any actual reallocation. Florian Weimer pointed out that this doesn't solve the problem of an allocator potentially growing usable size at will, which will break the implicit assumption in systemd use that the value returned remains constant as long as the object is valid. The safest way to fix that is for systemd to step away from using malloc_usable_size() like this. Resolves #22801.
* sd-device: introduce device_unref_and_replace()Yu Watanabe2022-07-231-0/+11
|
* tree-wide: Introduce free_and_replace_full()Daan De Meyer2022-07-211-2/+5
| | | | | Let's have all our free_and_replace() functions use a single implementation.
* Revert "Support -D_FORTIFY_SOURCE=3 by using __builtin_dynamic_object_size."Evgeny Vereshchagin2022-06-051-13/+3
| | | | | | | | | | | | | | | | | | | | | This reverts commit 0bd292567a543d124cd303f7dd61169a209cae64. It isn't guaranteed anywhere that __builtin_dynamic_object_size can always deduce the size of every object passed to it so systemd can end up using either malloc_usable_size or __builtin_dynamic_object_size when pointers are passed around, which in turn can lead to actual segfaults like the one mentioned in https://github.com/systemd/systemd/issues/23619. Apparently __builtin_object_size can return different results for pointers referring to the same memory as well but somehow it hasn't caused any issues yet. Looks like this whole malloc_usable_size/FORTIFY_SOURCE stuff should be revisited. Closes https://github.com/systemd/systemd/issues/23619 and https://github.com/systemd/systemd/issues/23150. Reopens https://github.com/systemd/systemd/issues/22801
* basic/alloc-util: remove unnecessary parensZbigniew Jędrzejewski-Szmek2022-05-101-2/+2
| | | | Those symbols are not macros anymore, so we can drop parens.
* Support -D_FORTIFY_SOURCE=3 by using __builtin_dynamic_object_size.Martin Liska2022-03-311-3/+13
| | | | | | | As explained in the issue, -D_FORTIFY_SOURCE=3 requires usage of __builtin_dynamic_object_size in MALLOC_SIZEOF_SAFE macro. Fixes: #22801
* alloc-util: introduce mfree_func_type_tYu Watanabe2022-03-111-0/+1
|
* Merge pull request #20983 from mxre/feature/aarch64Lennart Poettering2021-10-151-6/+0
|\ | | | | [sd-stub] Add support for aarch64 booting via pe-entry point
| * move mfree to macro-fundamentals.hMax Resch2021-10-121-6/+0
| |
* | alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhereLennart Poettering2021-10-141-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Let's define two helpers strdupa_safe() + strndupa_safe() which do the same as their non-safe counterparts, except that they abort if called with allocations larger than ALLOCA_MAX. This should ensure that all our alloca() based allocations are subject to this limit. afaics glibc offers three alloca() based APIs: alloca() itself, strndupa() + strdupa(). With this we have now replacements for all of them, that take the limit into account.
* | alloca-util: drop two unnecessary castsLennart Poettering2021-10-141-2/+2
| | | | | | | | memset() already returns void*, no need to cast it to that.
* | alloc-util: introduce new helper alloca_safe()Lennart Poettering2021-10-141-12/+13
|/ | | | | | | | | | This is like alloca(), but does two things: 1. Verifies the allocation is smaller than ALLOCA_MAX 2. Ensures we allocate at least one byte This was previously done manually in all invocations. This adds a handy helper that does that implicitly.
* alloc-util: make mfree() typesafeLennart Poettering2021-08-101-4/+5
| | | | | | Make sure we return the same type as we accept. One incorrect use of mfree() is discovered and fixed this way.
* alloc-util: drop double eval from free_and_replace()Lennart Poettering2021-07-291-3/+5
| | | | Inspired by: 2744c7bb0176dc6b86a69acd4c449ea9e269e097
* systemctl: unset const char* arguments in static destructorsZbigniew Jędrzejewski-Szmek2021-05-311-0/+7
| | | | | | | | | | | | | | | | | | | | | | | When fuzzing, the following happens: - we parse 'data' and produce an argv array, - one of the items in argv is assigned to arg_host, - the argv array is subsequently freed by strv_freep(), and arg_host has a dangling symlink. In normal use, argv is static, so arg_host can never become a dangling pointer. In fuzz-systemctl-parse-argv, if we repeatedly parse the same array, we have some dangling pointers while we're in the middle of parsing. If we parse the same array a second time, at the end all the dangling pointers will have been replaced again. But for a short time, if parsing one of the arguments uses another argument, we would use a dangling pointer. Such a case occurs when we have --host=… --boot-loader-entry=help. The latter calls acquire_bus() which uses arg_host. I'm not particularly happy with making the code more complicated just for fuzzing, but I think it's better to resolve this, even if the issue cannot occur in normal invocations, than to deal with fuzzer reports. Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31714.
* Merge pull request #19662 from yuwata/memdupLennart Poettering2021-05-191-2/+2
|\ | | | | util: make memdup() or friends safer
| * alloc-util: use memcpy_safe() in memdup() or friendsYu Watanabe2021-05-191-2/+2
| |
* | alloc-util: simplify GREEDY_REALLOC() logic by relying on malloc_usable_size()Lennart Poettering2021-05-191-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We recently started making more use of malloc_usable_size() and rely on it (see the string_erase() story). Given that we don't really support sytems where malloc_usable_size() cannot be trusted beyond statistics anyway, let's go fully in and rework GREEDY_REALLOC() on top of it: instead of passing around and maintaining the currenly allocated size everywhere, let's just derive it automatically from malloc_usable_size(). I am mostly after this for the simplicity this brings. It also brings minor efficiency improvements I guess, but things become so much nicer to look at if we can avoid these allocation size variables everywhere. Note that the malloc_usable_size() man page says relying on it wasn't "good programming practice", but I think it does this for reasons that don't apply here: the greedy realloc logic specifically doesn't rely on the returned extra size, beyond the fact that it is equal or larger than what was requested. (This commit was supposed to be a quick patch btw, but apparently we use the greedy realloc stuff quite a bit across the codebase, so this ends up touching *a*lot* of code.)
* | alloc-util: add MALLOC_ELEMENTSOF() helperLennart Poettering2021-05-191-0/+8
| | | | | | | | | | | | | | This is a wrapper around malloc_usable_size() but is typesafe, and divides by the element size. A test it is also added ensuring what it does it does correcly.
* | alloc-util: introduce MALLOC_SIZEOF_SAFE() helperLennart Poettering2021-05-191-0/+12
|/ | | | | | | | | It's a wrapper around malloc_usable_size() that is supposed to be compatible with _FORTIFY_SOURCES=1, by taking the __builtin_object_size() data into account, the same way as the _FORTIFY_SOURCES=1 logic does. Fixes: #19203
* basic/alloc-util: also reset the cleaned-up variable in freep()Zbigniew Jędrzejewski-Szmek2021-02-191-1/+1
| | | | | | | | | | | | | | | | | freep() has it's own definition, so I missed it in fd421c4adc7406de02e03e2f7ceede2cc6e1d9d4. Again, there is a small growth, but the compiler should be able to optimize it away: -Dbuildtype=debug: -rwxrwxr-x 1 zbyszek zbyszek 4106816 Feb 19 12:52 build/libsystemd.so.0.30.0 -rwxrwxr-x 1 zbyszek zbyszek 7492952 Feb 19 12:52 build/src/shared/libsystemd-shared-247.so -rwxrwxr-x 1 zbyszek zbyszek 4472624 Feb 19 12:53 build/systemd -rwxrwxr-x 1 zbyszek zbyszek 4107056 Feb 19 13:03 build/libsystemd.so.0.30.0 -rwxrwxr-x 1 zbyszek zbyszek 7493480 Feb 19 13:03 build/src/shared/libsystemd-shared-247.so -rwxrwxr-x 1 zbyszek zbyszek 4472760 Feb 19 13:03 build/systemd Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31055.
* fundamental: move several macros and functions into src/fundamental/Yu Watanabe2021-02-091-9/+0
| | | | | | | | | | sd-boot has a copy of a subset of codes from libbasic. This makes sd-boot share the code with libbasic, and dedup the code. Note, startswith_no_case() is dropped from sd-boot, as - it is not used, - the previous implementation is not correct, - gnu-efi does not have StrniCmp() or so.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* alloc-util: avoid allocating zero size memory blocksLennart Poettering2020-10-141-6/+6
| | | | | It's not clear what libc's make of this. We clamp to 1 byte allocations in most cases already, let's add this for a few where this was missing.
* alloc-util: drop _alloc_ decorator from memdup_suffix0()Lennart Poettering2019-07-131-1/+1
| | | | Fixes: https://github.com/systemd/systemd/pull/13034#issuecomment-510801671
* alloc-util: drop _alloc_(2, 3) decorator from memdup_suffix0_multiply()Lennart Poettering2019-07-121-1/+3
| | | | | | | This decorator tells compilers that the memory we return is shorter than it actually is, thus triggering misleading bad memory access complaints. Fixes: #13026
* alloc-util: typo fixLennart Poettering2019-03-201-2/+2
|
* Add wrapper for __msan_unpoinson() to reduce #ifdefferyZbigniew Jędrzejewski-Szmek2019-02-251-0/+10
| | | | | | This isn't really necessary for the subsequent commit, but I expect that we'll need to unpoison more often once we turn on msan in CI, so I think think this change makes sense in the long run.
* alloc-util: whenever any of our alloca() wrappers is used to allocate overly ↵Lennart Poettering2019-01-261-17/+32
| | | | | | | | | | | large memory blocks, hit an assert() Of course, this should never happen, but let's better be safe than sorry, and abort rather than continue when a too large memory block is allocated, simply asa safety precaution. An early abort is better than continuing with a likely memory corruption later.
* tree-wide: make new/new0/malloc_multiply/reallocarray safe for size 0Zbigniew Jędrzejewski-Szmek2018-12-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | All underlying glibc calls are free to return NULL if the size argument is 0. We most often call those functions with a fixed argument, or at least something which obviously cannot be zero, but it's too easy to forget. E.g. coverity complains about "rows = new0(JsonVariant*, n_rows-1);" in format-table.c There is an assert that n_rows > 0, so we could hit this corner case here. Let's simplify callers and make those functions "safe". CID #1397035. The compiler is mostly able to optimize this away: $ size build{,-opt}/src/shared/libsystemd-shared-239.so (before) text data bss dec hex filename 2643329 580940 3112 3227381 313ef5 build/src/shared/libsystemd-shared-239.so (-O0 -g) 2170013 578588 3089 2751690 29fcca build-opt/src/shared/libsystemd-shared-239.so (-03 -flto -g) (after) text data bss dec hex filename 2644017 580940 3112 3228069 3141a5 build/src/shared/libsystemd-shared-239.so 2170765 578588 3057 2752410 29ff9a build-opt/src/shared/libsystemd-shared-239.so
* util: define free_func_tYu Watanabe2018-12-021-0/+2
|
* alloc-util: add alloca() counterparts for memdup() and memdup_suffix0()Lennart Poettering2018-10-151-0/+15
|
* Revert "alloc-util: return NULL if 0-sized allocation is requested"Yu Watanabe2018-10-131-4/+1
| | | | This reverts commit c05107767b589e9aac9711eb385738887f86eb77.
* alloc-util: return NULL if 0-sized allocation is requestedDavid Tardon2018-10-121-1/+4
| | | | | That would almost certainly be an error (e.g., an overflow in computing _need_), so it's better to fail.
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-4/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* alloca: add an overflow check tooLennart Poettering2018-04-271-2/+10
| | | | | | | | | Of course, alloca() shouldn't be used with anything that can grow without bounds anyway, but let's better safe than sorry, and catch this early. Since alloca() is not supposed to return an error we trigger an assert() instead, which is still better than heap trickery.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* macro: introduce TAKE_PTR() macroLennart Poettering2018-03-221-0/+9
| | | | | | | | | | | | | | | | This macro will read a pointer of any type, return it, and set the pointer to NULL. This is useful as an explicit concept of passing ownership of a memory area between pointers. This takes inspiration from Rust: https://doc.rust-lang.org/std/option/enum.Option.html#method.take and was suggested by Alan Jenkins (@sourcejedi). It drops ~160 lines of code from our codebase, which makes me like it. Also, I think it clarifies passing of ownership, and thus helps readability a bit (at least for the initiated who know the new macro)
* tree-wide: use reallocarray instead of our home-grown realloc_multiply (#8279)Zbigniew Jędrzejewski-Szmek2018-02-261-1/+3
| | | | | | | There isn't much difference, but in general we prefer to use the standard functions. glibc provides reallocarray since version 2.26. I moved explicit_bzero is configure test to the bottom, so that the two stdlib functions are at the bottom.
* alloc-util: coding style fixYu Watanabe2017-11-281-1/+1
|
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* alloc-util: add new helpers memdup_suffix0() and newdup_suffix0()Lennart Poettering2017-07-311-0/+10
| | | | | | | These are similar to memdup() and newdup(), but reserve one extra NUL byte at the end of the new allocation and initialize it. It's useful when copying out data from fixed size character arrays where NUL termination can't be assumed.
* tree-wide: introduce free_and_replace helperZbigniew Jędrzejewski-Szmek2016-10-171-0/+8
| | | | | | It's a common pattern, so add a helper for it. A macro is necessary because a function that takes a pointer to a pointer would be type specific, similarly to cleanup functions. Seems better to use a macro.
* alloc-util: cleanupsAlexander Kuleshov2016-02-181-9/+13
| | | | | | | | | | | | | | | This patch contains a set of little cleanups for alloc-util.h: 1. The malloc_multiply(), realloc_multiply() and memdup_multiply() functions check allocation related parameters on overflow. Let's move them to the separate size_multiply_overflow() function for simplicity, code duplication prevention and possible reuse in future. 2. use SIZE_MAX from stdlib instead of ((size_t) - 1) to be more clear. 3. The 'a'/'b' variables are renamed to 'size' and 'need' to be more clear.'
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* basic: include only what we useThomas Hindoe Paaboel Andersen2015-11-301-0/+1
| | | | | This is a cleaned up result of running iwyu but without forward declarations on src/basic.
* util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering2015-10-271-0/+108
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 08:34:09 +0100