diff options
| author | Freeman Wang <xwang@ubicom.com> | 2009-12-19 13:43:00 -0800 |
|---|---|---|
| committer | Austin Foxley <austinf@cetoncorp.com> | 2009-12-19 13:53:32 -0800 |
| commit | 23528282b771d1af3df0fa17f1e909ad3b663f59 (patch) | |
| tree | b51c4b640cf7f22708e027739e322dc573a3d430 /libc/stdlib/malloc/free.c | |
| parent | 7dcd83e8bded560b6a2c658889995390d3021a92 (diff) | |
malloc: fix race condition and other bugs in the no-mmu malloc
Fixes multiple race conditions on mmb list. This was done by
making the mmb_heap_lock into a recursive lock and making the
regular heap_lock extend to cover the mmb heap handling.
Also move the new_mmb allocation up to before the mmb list is
iterated through to find the insertion point. When the mmb_heap
also runs out and needs to be extended when the regular heap is
just extended, the mmb list could be messed up.
Signed-off-by: Freeman Wang <xwang@ubicom.com>
Signed-off-by: Austin Foxley <austinf@cetoncorp.com>
Diffstat (limited to 'libc/stdlib/malloc/free.c')
| -rw-r--r-- | libc/stdlib/malloc/free.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libc/stdlib/malloc/free.c b/libc/stdlib/malloc/free.c index c17e7ec2a..e7b6a290a 100644 --- a/libc/stdlib/malloc/free.c +++ b/libc/stdlib/malloc/free.c @@ -177,14 +177,14 @@ __free_to_heap (void *mem, struct heap_free_area **heap /* Start searching again from the end of this block. */ start = mmb_end; + /* Release the descriptor block we used. */ + free_to_heap (mmb, &__malloc_mmb_heap, &__malloc_mmb_heap_lock); + /* We have to unlock the heap before we recurse to free the mmb descriptor, because we might be unmapping from the mmb heap. */ __heap_unlock (heap_lock); - /* Release the descriptor block we used. */ - free_to_heap (mmb, &__malloc_mmb_heap, &__malloc_mmb_heap_lock); - /* Do the actual munmap. */ munmap ((void *)mmb_start, mmb_end - mmb_start); |