1

I allocated some large chunks of memory through malloc and aligned_alloc, and then I setup a fence to a region inside the memory with size of one page size, using mprotect:

void *buf = malloc(128 * PAGE_SIZE);
int ret = mprotect(buf, PAGE_SIZE, PROT_NONE);

Now I'm done with the memory and is calling free(buf); to release it, my questions is do I need to reset mprotect before calling free, like this:

ret = mprotect(buf, PAGE_SIZE, PROT_READ|PROT_WRITE);
free(buf);

Or should I just do free? I read that glibc will sometimes reuse some of the previously allocated memory, so if this region of memory is returned to later malloc, will accessing it cause problems(since it's PROT_NONE)?

fluter
  • 13,238
  • 8
  • 62
  • 100

2 Answers2

1

Malloc allocated from the heap does not necessarily request the memory from the system. Likewise free does not necessarily return the memory to the system.

For what you are doing you should use mmap munmap which always goes to the system. If you use mfree there is no need to call mprotect beforehand.

mrks
  • 8,033
  • 1
  • 33
  • 62
doron
  • 27,972
  • 12
  • 65
  • 103
  • What is this mfree are you talking about? Do you mean munmap? – fluter Apr 30 '17 at 08:28
  • Sorry, I do mean munmap. Corrected now. My bad – doron Apr 30 '17 at 11:20
  • What about malloc? Is it wrong to use mprotect on malloc'ed memory? Or is it implementation dependent? or even undefined behavior? – fluter Apr 30 '17 at 13:39
  • Yes, don't use mprotect on malloced memory. Malloc is a heap allocator that manages memory that may be less than an OS page. mprotect needs a whole page since access attributes only have page granuality. – doron Apr 30 '17 at 15:49
1

On top of @doron 's answer, I digged a little more because I was specifically working on Linux. According posix standard of mprotect:

The behavior of this function is unspecified if the mapping was not established by a call to mmap().

While on Linux, it is a bit different:

On Linux it is always permissible to call mprotect() on any address in a process's address space (except for the kernel vsyscall area). In particular it can be used to change existing code mappings to be writable.

That means it is indeed allowed to call mprotect on malloc'ed memory regions, but free will not reset it as there is no way to know the old protection flags, so I have to reset the flags before calling free.

In fact, this is exactly the problem I met, when the program runs for a while, it randomly crashes in malloc, that is because malloc is writing it's housekeeping data into the previously allocated memory and that memory was set to PROT_NONE by an earlier mprotect, after I set the memory to writable before calling free, the program never crash again.

That's being said, this is only on Linux, to write portable program, one should use mprotect only on mmap'ed memory.

fluter
  • 13,238
  • 8
  • 62
  • 100