From 619f284195fdc856a4dfae7cc0cdeedd19a9e980 Mon Sep 17 00:00:00 2001 From: Pawel Jakub Dawidek Date: Wed, 28 Dec 2005 01:53:13 +0000 Subject: [PATCH] In realloc(9), determine size of the original block based on UMA_SLAB_MALLOC flag. In some circumstances (I observed it when I was doing a lot of reallocs) UMA_SLAB_MALLOC can be set even if us_keg != NULL. If this is the case we have wonderful, silent data corruption, because less data is copied to the newly allocated region than should be. I'm not sure when this bug was introduced, it could be there undetected for years now, as we don't have a lot of realloc(9) consumers and it was hard to reproduce it... ...but what I know for sure, is that I don't want to know who introduce the bug:) It took me two/three days to track it down (of course most of the time I was looking for the bug in my own code). --- sys/kern/kern_malloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/kern/kern_malloc.c b/sys/kern/kern_malloc.c index 4b707aa171a..4864277dd7d 100644 --- a/sys/kern/kern_malloc.c +++ b/sys/kern/kern_malloc.c @@ -437,7 +437,7 @@ if (mtp == M_SUBPROC) { ("realloc: address %p out of range", (void *)addr)); /* Get the size of the original block */ - if (slab->us_keg) + if (!(slab->us_flags & UMA_SLAB_MALLOC)) alloc = slab->us_keg->uk_size; else alloc = slab->us_size;