Custom Memory Mapped Allocator SEGFAULTs on allocate after freeing - c

Question

So I needed a simple allocator to allocate (on occasion with zeroing) and later free 4K blocks from a pool of mapped memory. However, after implementing this, while testing I found that after freeing a block or two, if I tried to allocate a block, the program would SEGFAULT.
Curiously enough, when I free multiple blocks in a row, nothing seems to break.
Some important definitions collected from other files:
#define xmattr_constant __attribute__((const))
#define xmattr_malloc __attribute__((malloc))
#define xmattr_pure __attribute__((pure))
#define xm_likely(x) __builtin_expect(!!(x), 1)
#define xm_unlikely(x) __builtin_expect(!!(x), 0)
#define ABLKLEN 4096 // 4K pagesize
typedef struct {
uint8_t magic[16]; // "sfDB5" "vX.XXXXXXX" '\0'
uint8_t *freelist;
uint64_t size;
uint64_t bounds;
} arenaheader;
Allocation code:
void *pd_arena;
void pd_init (size_t len, uint8_t *map) {
int x;
size_t const block = len / 256; // arena physical size
size_t const size = (block / ABLKLEN) * ABLKLEN; // arena useable size
arenaheader *header;
for (x = 0; x < 256; x++) {
header = (void *) &(map[x * block]);
header->freelist = NULL; // no free blocks because all are free
header->size = size; // useable size
header->bounds = ABLKLEN; // current bounds
}
return;
}
xmattr_malloc void *pd_mallocBK (void) {
arenaheader *header = pd_arena;
uint8_t *ptr;
if (xm_unlikely (header->freelist)) { // there's a sitting free block
ptr = header->freelist; // return the free block
void **next = ptr;
header->freelist = *next; // update the free list
} else if (xm_likely (header->bounds < header->size)) { // no free blocks
ptr = pd_arena;
ptr += header->size;
header->size += ABLKLEN;
} else { // no more blocks
ptr = NULL;
}
return ptr;
}
xmattr_malloc void *pd_callocBK (void) {
void *ptr = pd_mallocBK ();
if (xm_likely (ptr)) // allocation was successful
memset (ptr, 0, ABLKLEN);
return ptr;
}
void pd_freeBK (void *ptr) {
arenaheader *header = pd_arena;
if (xm_likely (ptr)) { // non-NULL ptr
void *next = header->freelist; // get current top of stack
void **this = ptr;
*this = next; // move address of current top of stack to ptr
header->freelist = ptr; // push ptr to stack
}
return;
}
Test code:
#define F_LEN (1024 * 1024 * 1024) // 1 GB
#define A_LEN (F_LEN / 256)
int main (int argc, char **argv) {
int x, y;
// setup
int fd;
uint8_t *map;
assert (fd = open ("./pd_single.testout", O_CREAT | O_RDWR | O_EXCL));
if (ftruncate (fd, F_LEN)) {
perror ("ftruncate failed: ");
return 1;
}
assert (map = mmap (NULL, F_LEN, PROT_READ | PROT_WRITE, MAP_FILE | MAP_SHARED, fd, 0));
uint8_t *arena[256];
for (x = 0; x < 256; x++)
arena[x] = map + (x * A_LEN);
// test
volatile int *var;
void *list[512];
int lcnt = 0;
pd_init (F_LEN, map);
// per arena test
for (x = 0; x < 256; x++) {
pd_arena = arena[x];
// allocate and write a few times
for (y = 0; y < 256; y++) {
assert ((list[lcnt] = pd_mallocBK ()));
var = list[lcnt];
*var = (x + 1) * (y + 1);
}
// free some but not all
for (y = 0; y < 64; y++)
pd_freeBK (list[lcnt]);
// now reallocate some and write some
for (y = 0; y < 16; y++) {
assert ((list[lcnt] = pd_mallocBK()));
var = list[lcnt];
*var = 16;
}
}
// cleanup
munmap (map, F_LEN);
close (fd);
return 0;
}
After running the program through gdb, I found that it SEGFAULTs within pd_mallocBK(); specifically, on this line:
header->freelist = *next; // update the free list
However, I can't seem to understand what is wrong with that line and/or how to fix it.
So, two questions, really (in order of importance, most to least):
What is wrong with the selected line and how can I fix it?
Are there any other allocators to which I can simply assign a region of mapped memory to use instead of having to implement this?

Answer 1

The following code works better than the original, but still crashes eventually when starting to work on the last arena.
#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>
#define xmattr_malloc __attribute__((malloc))
#define xm_likely(x) __builtin_expect(!!(x), 1)
#define xm_unlikely(x) __builtin_expect(!!(x), 0)
enum { ABLKLEN = 4096 };
void pd_freeBK(void *ptr);
xmattr_malloc void *pd_callocBK(void);
xmattr_malloc void *pd_mallocBK(void);
void pd_init(size_t len, uint8_t *map);
typedef struct {
uint8_t magic[16]; // "sfDB5" "vX.XXXXXXX" '\0'
uint8_t *freelist;
uint64_t size;
uint64_t bounds;
} arenaheader;
static void *pd_arena;
static void pd_dump_arena(FILE *fp, const char *tag, const arenaheader *arena)
{
assert(arena != NULL);
fprintf(fp, "Arena: 0x%.8" PRIXPTR " - %s\n", (uintptr_t)arena, tag);
fprintf(fp, "Size: %.8" PRIu64 ", Bounds: %.8" PRIu64 ", Freelist: 0x%.8" PRIXPTR "\n",
arena->size, arena->bounds, (uintptr_t)arena->freelist);
}
void pd_init(size_t len, uint8_t *map)
{
size_t const block = len / 256; // arena physical size
size_t const size = (block / ABLKLEN) * ABLKLEN; // arena useable size
arenaheader *header;
for (int x = 0; x < 256; x++)
{
header = (void *) &(map[x * block]);
header->freelist = NULL; // no free blocks because all are free
header->size = size; // useable size
header->bounds = ABLKLEN; // current bounds
}
for (int x = 0; x < 256; x++)
{
char buffer[32];
sprintf(buffer, "arena %.3d", x);
pd_dump_arena(stdout, buffer, (arenaheader *)&map[x * block]);
}
}
xmattr_malloc void *pd_mallocBK(void)
{
arenaheader *header = pd_arena;
void *ptr;
if (xm_unlikely(header->freelist)) // there's a sitting free block
{
ptr = header->freelist; // return the free block
void **next = ptr;
header->freelist = *next; // update the free list
}
else if (xm_likely(header->bounds < header->size)) // no free blocks
{
ptr = pd_arena;
ptr = (uint8_t *)ptr + header->size;
header->size += ABLKLEN;
}
else // no more blocks
{
ptr = NULL;
}
return ptr;
}
xmattr_malloc void *pd_callocBK(void)
{
void *ptr = pd_mallocBK();
if (xm_likely(ptr)) // allocation was successful
memset(ptr, 0, ABLKLEN);
return ptr;
}
void pd_freeBK(void *ptr)
{
arenaheader *header = pd_arena;
if (xm_likely(ptr)) // non-NULL ptr
{
void *next = header->freelist; // get current top of stack
void **this = ptr;
*this = next; // move address of current top of stack to ptr
header->freelist = ptr; // push ptr to stack
}
}
enum { NUM_ARENAS = 256 };
#define F_LEN (1024 * 1024 * 1024) // 1 GB
#define A_LEN (F_LEN / NUM_ARENAS)
int main(void)
{
const char filename[] = "./pd_single.testout";
// setup
//int fd = open(filename, O_CREAT | O_RDWR | O_EXCL, 0444);
int fd = open(filename, O_CREAT | O_RDWR, 0600);
assert(fd >= 0);
if (ftruncate(fd, F_LEN))
{
unlink(filename);
perror("ftruncate failed: ");
return 1;
}
uint8_t *map = mmap(NULL, F_LEN, PROT_READ | PROT_WRITE, MAP_FILE | MAP_SHARED, fd, 0);
assert(map != MAP_FAILED);
uint8_t *arena[NUM_ARENAS];
for (int x = 0; x < NUM_ARENAS; x++)
arena[x] = map + (x * A_LEN);
pd_init(F_LEN, map);
// test
void *list[512];
// per arena test
for (int x = 0; x < NUM_ARENAS; x++)
{
int lcnt = 0;
pd_arena = arena[x];
printf("Arena[%.3d] = 0x%.8" PRIXPTR "\n", x, (uintptr_t)pd_arena);
// allocate and write a few times
for (int y = 0; y < 256; y++)
{
assert((list[lcnt] = pd_mallocBK()));
int *var = list[lcnt];
*var = (x + 1) * (y + 1);
printf("[%.3d] data 0x%.8" PRIXPTR " = %d\n", y, (uintptr_t)list[lcnt], *var);
lcnt++;
}
// free some but not all
lcnt = 0;
for (int y = 0; y < 64; y++)
{
printf("[%.3d] free 0x%.8" PRIXPTR " = %d\n", y, (uintptr_t)list[lcnt], *(int *)list[lcnt]);
pd_freeBK(list[lcnt]);
lcnt++;
}
// now reallocate some and write some
lcnt = 0;
for (int y = 0; y < 16; y++)
{
assert((list[lcnt] = pd_mallocBK()));
int *var = list[lcnt];
*var = 16;
printf("[%.3d] data 0x%.8" PRIXPTR " = %d\n", y, (uintptr_t)list[lcnt], *var);
lcnt++;
}
}
// cleanup
munmap(map, F_LEN);
close(fd);
unlink(filename);
return 0;
}
I've not yet tracked down the residual bug. Note the diagnostic printing (verbose) and the different handling of lcnt in main(). You were busy freeing the same memory multiple times, but not detecting that in your pd_freeBK() code. You were also leaking memory because you were not incrementing lcnt in main().