All the mail mirrored from lore.kernel.org
 help / color / mirror / Atom feed

From: Bean <bean123ch@gmail.com>
To: The development of GNU GRUB <grub-devel@gnu.org>
Subject: Re: Mysterious memory corruption bug
Date: Wed, 2 May 2012 03:46:03 +0800	[thread overview]
Message-ID: <CAF-6-Q2nj3Jh7e=0dovm6RDSa8FY9jJgT3mEB33Y3Y-MVDd9Tw@mail.gmail.com> (raw)
In-Reply-To: <4FA034B2.2030400@gmail.com>

On Wed, May 2, 2012 at 3:08 AM, Vladimir 'φ-coder/phcoder' Serbinenko
<phcoder@gmail.com> wrote:
> On 01.05.2012 20:53, Bean wrote:
>> Hi,
>>
>> Thanks to Vladimir's memory patch, it's actually quite easy to
>> reproduce mysterious issue.
>>
>> First, there are two memory leaks in ip.c.
>>
>> It allocates the rsm but never frees it. free_rsm frees its content,
>> but not the pointer itself. You can see it in printmem at ip.c:473
>>       rsm = grub_malloc (sizeof (*rsm));
>>
>> Another problem is at ip.c:594:
>>   return handle_dgram (ret, card, src_hwaddress,
>>                              hwaddress, proto, &source, &dest,
>>                              ttl);
>> here, ret is netbuff. grub_netbuff_alloc get a buffer for both data
>> and header (data go first), so when it frees the data pointer, the
>> header goes away as well. But here, the header is allocated separately
>> so that it's not free using , you can see it from printmem at ip.c:580
>>       ret = grub_malloc (sizeof (*ret));
>>
>> Now here's the tricky part, when i fix both problem, it actually when
>> you call this: (memdisk size is 19,180, just in case it matters).
>>
>> testspeed /memdisk
>>
>> So there must be a memory corruption somewhere.
> You can check for memory corruptions by calling grub_mm_check often
> enough in the code.

Hi,

Thanks for the tip. But when I add a few grub_mm_check and printf here
and there, it doesn't halt any more. So this could be a memory
overflown issue or even compiler bug, very strange indeed.

-- 
Best wishes
Bean

next prev parent reply	other threads:[~2012-05-01 19:46 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-05-01 18:53 Mysterious memory corruption bug Bean
2012-05-01 19:08 ` Vladimir 'φ-coder/phcoder' Serbinenko
2012-05-01 19:46   ` Bean [this message]
2012-05-01 19:52     ` Bean
2012-05-01 19:56       ` Vladimir 'φ-coder/phcoder' Serbinenko
2012-05-01 20:02         ` Bean
2012-05-01 20:06           ` Vladimir 'φ-coder/phcoder' Serbinenko
2012-05-01 20:09             ` Bean
2012-05-01 20:16               ` Vladimir 'φ-coder/phcoder' Serbinenko
2012-05-01 20:34                 ` Bean
2012-05-01 20:35                   ` unsubscribe Daniel Senderowicz
2012-05-01 20:43                     ` unsubscribe Gregg Levine

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAF-6-Q2nj3Jh7e=0dovm6RDSa8FY9jJgT3mEB33Y3Y-MVDd9Tw@mail.gmail.com' \
    --to=bean123ch@gmail.com \
    --cc=grub-devel@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.