authorgravatar for 19855629+SuperAuguste@users.noreply.github.comAuguste Rame <19855629+SuperAuguste@users.noreply.github.com> 2025-04-02 08:15:04-04:00
committergravatar for alex@alexrp.comAlex Rønne Petersen <alex@alexrp.com> 2025-04-02 14:22:15+02:00
log0b4176891c33c990e9d40523a8eaceea6d172c8e
treefea1e4583b67291379bd3fdd74244045d8bc502c
parentceb84c647b5cf6ad6a17b829a78e1c079a6ab5a5
signaturebadge-check Signed by SSH key SHA256:7B/LJ7bpR1eX8aCXSr4mtd5M45VMPKcx9zY8e95b5QM

DebugAllocator: Fix bucket removal logic causing segfault/leak (#23390)

Make buckets doubly linked

1 files changed, 16 insertions(+), 2 deletions(-)

lib/std/heap/debug_allocator.zig+16-2
......@@ -281,6 +281,7 @@ pub fn DebugAllocator(comptime config: Config) type {
281281 allocated_count: SlotIndex,
282282 freed_count: SlotIndex,
283283 prev: ?*BucketHeader,
284 next: ?*BucketHeader,
284285 canary: usize = config.canary,
285286
286287 fn fromPage(page_addr: usize, slot_count: usize) *BucketHeader {
......@@ -782,7 +783,11 @@ pub fn DebugAllocator(comptime config: Config) type {
782783 .allocated_count = 1,
783784 .freed_count = 0,
784785 .prev = self.buckets[size_class_index],
786 .next = null,
785787 };
788 if (self.buckets[size_class_index]) |old_head| {
789 old_head.next = bucket;
790 }
786791 self.buckets[size_class_index] = bucket;
787792
788793 if (!config.backing_allocator_zeroes) {
......@@ -935,9 +940,18 @@ pub fn DebugAllocator(comptime config: Config) type {
935940 }
936941 bucket.freed_count += 1;
937942 if (bucket.freed_count == bucket.allocated_count) {
938 if (self.buckets[size_class_index] == bucket) {
939 self.buckets[size_class_index] = null;
943 if (bucket.prev) |prev| {
944 prev.next = bucket.next;
940945 }
946
947 if (bucket.next) |next| {
948 assert(self.buckets[size_class_index] != bucket);
949 next.prev = bucket.prev;
950 } else {
951 assert(self.buckets[size_class_index] == bucket);
952 self.buckets[size_class_index] = bucket.prev;
953 }
954
941955 if (!config.never_unmap) {
942956 const page: [*]align(page_size) u8 = @ptrFromInt(page_addr);
943957 self.backing_allocator.rawFree(page[0..page_size], page_align, @returnAddress());