critical: memory corruption when using threads and nedrealloc

[Gerilgfx]

---

bug type:

memory (chunk?) corruption, when using nedrealloc from multiple threads

---

reproducing:

-need many threads with simultanously touching nedmalloc
-needs the current newest nedmalloc files (no crash with previous version)
-tested with linux (64 bit)

if you replace nedmalloc to older version, OR if you disable threading, OR if you remove the nedrealloc, crash disappears

---

testsystem:

uname -r -a
Linux a1 3.1.0-1.2-desktop #1 SMP PREEMPT Thu Nov 3 14:45:45 UTC 2011 (187dde0) x86_64 x86_64 x86_64 GNU/Linux

g++ --version
g++ (SUSE Linux) 4.6.2

(64 bit binary used in test)

---

bug rating:

critical

---

bug results:

nedmalloc aborts on various locations, or stucks in infinite loop

---

output:

attempt 1:
0 percent finished
1 percent finished
(hangs in infinite loop)

attempt 2:
0 percent finished
....
...
...
66 percent finished
(hangs in infinite loop)

attempt 3:
0 percent finished
....
...
...
26 percent finished
nedmalloc: nedprealloc() called with a block not created by nedmalloc!
Aborted

---

testcase:

[Gerilgfx]

[source]

// g++ nedmalloctester2.c -o nedmalloctester2 -O3 -s -pthread

#define USE_LOCKS 1
#define USE_DL_PREFIX 1
#define NDEBUG
#define NO_NED_NAMESPACE

/*
// ok:
#include "nedmalloc/nedmalloc_11beta4/nedmalloc.h"
#include "nedmalloc/nedmalloc_11beta4/nedmalloc.c"
*/

// crash:
#include "nedmalloc/nedmalloc_2012nov22/nedmalloc.h"
#include "nedmalloc/nedmalloc_2012nov22/nedmalloc.c"

#define malloc_vpool nedmalloc
#define free_vpool nedfree
#define realloc_vpool nedrealloc

#define TESTMEMMAX 1024_1024_2

void ** test=NULL;

int div_w=8; // random block size to be sure that we touching pointers allocated from different thread ID-s

void malt(int thread){
for(int i=0;i<TESTMEMMAX;i++){
if(((i/div_w)%10)!=thread) continue; // 10 thread
// printf("%d\n", i);
if(test[i]){
if(rand()%2){
free_vpool(test[i]);
test[i]=malloc_vpool(1+rand()%100);
}else{
// you can comment this line out, and the program does not crash animore.
test[i]=realloc_vpool(test[i], 1+rand()%100);
}
}else{
test[i]=malloc_vpool(1+rand()%100);
}
}
}

void *malt2(void * threadid){malt(1);}
void *malt3(void * threadid){malt(2);}
void *malt4(void * threadid){malt(3);}
void *malt5(void * threadid){malt(4);}
void *malt6(void * threadid){malt(5);}
void *malt7(void * threadid){malt(6);}
void *malt8(void * threadid){malt(7);}
void *malt9(void * threadid){malt(8);}
void *malt10(void * threadid){malt(9);}

void MallocStabTest2(){
printf("test 2 begins...\n");

test=(void**)nedmalloc(TESTMEMMAX*sizeof(void*));
for(int i=0;i<(TESTMEMMAX);i++) test[i]=NULL;

for(int Z=0;Z<100;Z++){
    div_w=2+(rand()%40);  // random block size to be sure that we touching pointers allocated from different thread ID-s

    pthread_t TMP2=0;
    pthread_t TMP3=0;
    pthread_t TMP4=0;
    pthread_t TMP5=0;
    pthread_t TMP6=0;
    pthread_t TMP7=0;
    pthread_t TMP8=0;
    pthread_t TMP9=0;
    pthread_t TMP10=0;

    pthread_create(&TMP2, NULL, malt2, NULL);
    pthread_create(&TMP3, NULL, malt3, NULL);
    pthread_create(&TMP4, NULL, malt4, NULL);
    pthread_create(&TMP5, NULL, malt5, NULL);
    pthread_create(&TMP6, NULL, malt6, NULL);
    pthread_create(&TMP7, NULL, malt7, NULL);
    pthread_create(&TMP8, NULL, malt8, NULL);
    pthread_create(&TMP9, NULL, malt9, NULL);
    pthread_create(&TMP10, NULL, malt10, NULL);

    malt(0);

    pthread_join(TMP2, NULL);
    pthread_join(TMP3, NULL);
    pthread_join(TMP4, NULL);
    pthread_join(TMP5, NULL);
    pthread_join(TMP6, NULL);
    pthread_join(TMP7, NULL);
    pthread_join(TMP8, NULL);
    pthread_join(TMP9, NULL);
    pthread_join(TMP10, NULL);

    printf("%d percent finished\n", Z);
}

for(int i=0;i<(TESTMEMMAX);i++) if(test[i]) free_vpool(test[i]);
free_vpool(test);
printf("success.\n");

}

int main(){
MallocStabTest2();
}

[/source]

[Gerilgfx]

overwritting the nedmalloc.c.h with the older version seems to fix the problem too

[ned14]

You're absolutely right - that merge of latest dlmalloc ought to live in its own branch away from master until I get a chance to integrate it properly. I'll fix it up.

[ned14]

Ok, reverted to dlmalloc v2.8.4.