tomoaki/hakmem
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add SuperSlab refcount pinning and critical failsafe guards

Browse Source 
Major breakthrough: sh8bench now completes without SIGSEGV!
Added defensive refcounting and failsafe mechanisms to prevent
use-after-free and corruption propagation.

Changes:
1. SuperSlab Refcount Pinning (core/box/tls_sll_box.h)
   - tls_sll_push_impl: increment refcount before adding to list
   - tls_sll_pop_impl: decrement refcount when removing from list
   - Prevents SuperSlab from being freed while TLS SLL holds pointers

2. SuperSlab Release Guards (core/superslab_allocate.c, shared_pool_release.c)
   - Check refcount > 0 before freeing SuperSlab
   - If refcount > 0, defer release instead of freeing
   - Prevents use-after-free when TLS/remote/freelist hold stale pointers

3. TLS SLL Next Pointer Validation (core/box/tls_sll_box.h)
   - Detect invalid next pointer during traversal
   - Log [TLS_SLL_NEXT_INVALID] when detected
   - Drop list to prevent corruption propagation

4. Unified Cache Freelist Validation (core/front/tiny_unified_cache.c)
   - Validate freelist head before use
   - Log [UNIFIED_FREELIST_INVALID] for corrupted lists
   - Defensive drop to prevent bad allocations

5. Early Refcount Decrement Fix (core/tiny_free_fast.inc.h)
   - Removed ss_active_dec_one from fast path
   - Prevents premature refcount depletion
   - Defers decrement to proper cleanup path

Test Results:
✅ sh8bench completes successfully (exit code 0)
✅ No SIGSEGV or ABORT signals
✅ Short runs (5s) crash-free
⚠️ Multiple [TLS_SLL_NEXT_INVALID] / [UNIFIED_FREELIST_INVALID] logged
⚠️ Invalid pointers still present (stale references exist)

Status Analysis:
- Stability: ACHIEVED (no crashes)
- Root Cause: NOT FULLY SOLVED (invalid pointers remain)
- Approach: Defensive + refcount guards working well

Remaining Issues:
❌ Why does SuperSlab get unregistered while TLS SLL holds pointers?
❌ SuperSlab lifecycle: remote_queue / adopt / LRU interactions?
❌ Stale pointers indicate improper SuperSlab lifetime management

Performance Impact:
- Refcount operations: +1-3 cycles per push/pop (minor)
- Validation checks: +2-5 cycles (minor)
- Overall: < 5% overhead estimated

Next Investigation:
- Trace SuperSlab lifecycle (allocation → registration → unregister → free)
- Check remote_queue handling
- Verify adopt/LRU mechanisms
- Correlate stale pointer logs with SuperSlab unregister events

Log Volume Warning:
- May produce many diagnostic logs on long runs
- Consider ENV gating for production

Technical Notes:
- Refcount is per-SuperSlab, not global
- Guards prevent symptom propagation, not root cause
- Root cause is in SuperSlab lifecycle management

🤖 Generated with Claude Code (https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Moe Charm (CI)
2025-12-03 21:56:52 +09:00
parent cd6177d1de
commit 19ce4c1ac4
8 changed files with 236 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

173
core/box/tls_sll_box.h
View File

@ -220,6 +220,117 @@ static inline void tls_sll_sanitize_head(int class_idx, const char* stage)
}
}
static inline int tls_sll_check_node(int class_idx, void* raw, void* from_base, const char* stage)
{
if (!raw) return 1;
uintptr_t addr = (uintptr_t)raw;
if (addr < 4096 || addr > 0x00007fffffffffffULL) {
goto bad;
}
SuperSlab* ss = hak_super_lookup(raw);
int cap = ss ? ss_slabs_capacity(ss) : 0;
int idx = (ss && ss->magic == SUPERSLAB_MAGIC) ? slab_index_for(ss, raw) : -1;
uint8_t meta_cls = (idx >= 0 && idx < cap) ? ss->slabs[idx].class_idx : 0xff;
if (!ss || ss->magic != SUPERSLAB_MAGIC || idx < 0 || idx >= cap || meta_cls != (uint8_t)class_idx) {
goto bad;
}
#if HAKMEM_TINY_HEADER_CLASSIDX
{
uint8_t hdr = *(uint8_t*)raw;
uint8_t expect = HEADER_MAGIC | (class_idx & HEADER_CLASS_MASK);
if (hdr != expect) {
goto bad;
}
}
#endif
return 1;
bad:
static _Atomic uint32_t g_head_set_diag = 0;
uint32_t shot = atomic_fetch_add_explicit(&g_head_set_diag, 1, memory_order_relaxed);
if (shot < 8) {
uint8_t from_meta_cls = 0xff;
int from_idx = -1;
SuperSlab* from_ss = NULL;
TinySlabMeta* from_meta = NULL;
uint64_t from_meta_used = 0;
void* from_meta_freelist = NULL;
if (from_base) {
from_ss = hak_super_lookup(from_base);
int from_cap = from_ss ? ss_slabs_capacity(from_ss) : 0;
from_idx = (from_ss && from_ss->magic == SUPERSLAB_MAGIC) ? slab_index_for(from_ss, from_base) : -1;
if (from_idx >= 0 && from_idx < from_cap) {
from_meta = &from_ss->slabs[from_idx];
from_meta_cls = from_meta->class_idx;
from_meta_used = from_meta->used;
from_meta_freelist = from_meta->freelist;
}
}
// Dump raw next pointers stored in from_base for extra forensics
uintptr_t from_next_off0 = 0;
uintptr_t from_next_off1 = 0;
size_t next_off_dbg = tiny_next_off(class_idx);
if (from_base) {
memcpy(&from_next_off0, from_base, sizeof(from_next_off0));
memcpy(&from_next_off1, (uint8_t*)from_base + next_off_dbg, sizeof(from_next_off1));
}
fprintf(stderr,
"[TLS_SLL_SET_INVALID] stage=%s cls=%d head=%p meta_cls=%u idx=%d ss=%p "
"from_base=%p from_meta_cls=%u from_idx=%d from_ss=%p "
"from_meta_used=%llu from_meta_freelist=%p next_off=%zu next_raw0=%p next_raw1=%p "
"canary_before=%#llx canary_after=%#llx last_writer=%s last_push=%p\n",
stage ? stage : "(null)",
class_idx,
raw,
(unsigned)meta_cls,
idx,
ss,
from_base,
(unsigned)from_meta_cls,
from_idx,
(void*)from_ss,
(unsigned long long)from_meta_used,
from_meta_freelist,
next_off_dbg,
(void*)from_next_off0,
(void*)from_next_off1,
(unsigned long long)g_tls_canary_before_sll,
(unsigned long long)g_tls_canary_after_sll,
g_tls_sll_last_writer[class_idx] ? g_tls_sll_last_writer[class_idx] : "(null)",
HAK_BASE_TO_RAW(s_tls_sll_last_push[class_idx]));
void* bt[16];
int frames = backtrace(bt, 16);
backtrace_symbols_fd(bt, frames, fileno(stderr));
fflush(stderr);
}
return 0;
}
static inline void tls_sll_set_head(int class_idx, hak_base_ptr_t head, const char* stage)
{
void* raw = HAK_BASE_TO_RAW(head);
if (!tls_sll_check_node(class_idx, raw, NULL, stage)) {
abort();
}
g_tls_sll[class_idx].head = head;
tls_sll_record_writer(class_idx, stage ? stage : "set_head");
}
static inline void tls_sll_set_head_from(int class_idx, hak_base_ptr_t head, void* from_base, const char* stage)
{
void* raw = HAK_BASE_TO_RAW(head);
if (!tls_sll_check_node(class_idx, raw, from_base, stage)) {
abort();
}
g_tls_sll[class_idx].head = head;
tls_sll_record_writer(class_idx, stage ? stage : "set_head");
}
static inline void tls_sll_set_head_raw(int class_idx, void* raw_head, const char* stage)
{
tls_sll_set_head(class_idx, HAK_BASE_FROM_RAW(raw_head), stage);
}
static inline void tls_sll_log_hdr_mismatch(int class_idx, hak_base_ptr_t base, uint8_t got, uint8_t expect, const char* stage)
{
static _Atomic uint32_t g_hdr_mismatch_log = 0;
@ -328,10 +439,12 @@ static inline bool tls_sll_push_impl(int class_idx, hak_base_ptr_t ptr, uint32_t
// Detect meta/class mismatch on push (first few only).
bool push_valid = true;
SuperSlab* ss_ptr = NULL;
do {
static _Atomic uint32_t g_tls_sll_push_meta_mis = 0;
struct SuperSlab* ss = hak_super_lookup(raw_ptr);
if (ss && ss->magic == SUPERSLAB_MAGIC) {
ss_ptr = ss;
int sidx = slab_index_for(ss, raw_ptr);
if (sidx >= 0 && sidx < ss_slabs_capacity(ss)) {
uint8_t meta_cls = ss->slabs[sidx].class_idx;
@ -435,6 +548,11 @@ static inline bool tls_sll_push_impl(int class_idx, hak_base_ptr_t ptr, uint32_t
return false;
}
// Pin SuperSlab while node resides in TLS SLL (prevents premature free)
if (ss_ptr && ss_ptr->magic == SUPERSLAB_MAGIC) {
superslab_ref_inc(ss_ptr);
}
// DEBUG: Strict address check on push to catch corruption early
uintptr_t ptr_val = (uintptr_t)raw_ptr;
if (ptr_val < 4096 || ptr_val > 0x00007fffffffffffULL) {
@ -528,8 +646,7 @@ static inline bool tls_sll_push_impl(int class_idx, hak_base_ptr_t ptr, uint32_t
// Link new node to current head via Box API (offset is handled inside tiny_nextptr).
// Note: g_tls_sll[...].head is hak_base_ptr_t, but PTR_NEXT_WRITE takes void* val.
PTR_NEXT_WRITE("tls_push", class_idx, raw_ptr, 0, HAK_BASE_TO_RAW(g_tls_sll[class_idx].head));
g_tls_sll[class_idx].head = ptr;
tls_sll_record_writer(class_idx, "push");
tls_sll_set_head(class_idx, ptr, "push");
g_tls_sll[class_idx].count = cur + 1;
s_tls_sll_last_push[class_idx] = ptr;
@ -587,7 +704,7 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
// Sentinel guard: remote sentinel must never be in TLS SLL.
if (__builtin_expect((uintptr_t)raw_base == TINY_REMOTE_SENTINEL, 0)) {
g_tls_sll[class_idx].head = HAK_BASE_FROM_RAW(NULL);
tls_sll_set_head(class_idx, HAK_BASE_FROM_RAW(NULL), "pop_sentinel");
g_tls_sll[class_idx].count = 0;
tls_sll_record_writer(class_idx, "pop_sentinel_reset");
#if !HAKMEM_BUILD_RELEASE
@ -634,9 +751,8 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
class_idx, HAK_BASE_TO_RAW(s_tls_sll_last_push[class_idx]));
}
tls_sll_dump_tls_window(class_idx, "head_range");
g_tls_sll[class_idx].head = HAK_BASE_FROM_RAW(NULL);
tls_sll_set_head(class_idx, HAK_BASE_FROM_RAW(NULL), "pop_invalid_head");
g_tls_sll[class_idx].count = 0;
tls_sll_record_writer(class_idx, "pop_invalid_head");
return false;
}
#endif
@ -719,9 +835,8 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
fprintf(stderr, "[TLS_SLL_HDR_RESET] cls=%d base=%p got=0x%02x expect=0x%02x count=%llu\n",
class_idx, raw_base, got, expect, (unsigned long long)cnt);
}
g_tls_sll[class_idx].head = HAK_BASE_FROM_RAW(NULL);
tls_sll_set_head(class_idx, HAK_BASE_FROM_RAW(NULL), "header_reset");
g_tls_sll[class_idx].count = 0;
tls_sll_record_writer(class_idx, "header_reset");
{
static int g_sll_ring_en = -1;
if (__builtin_expect(g_sll_ring_en == -1, 0)) {
@ -746,6 +861,34 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
hak_base_ptr_t next = HAK_BASE_FROM_RAW(raw_next);
tls_sll_diag_next(class_idx, base, next, "pop_next");
// Validate next pointer before installing as new head.
if (!hak_base_is_null(next)) {
SuperSlab* next_ss = hak_super_lookup(raw_next);
int next_cap = next_ss ? ss_slabs_capacity(next_ss) : 0;
int next_idx = (next_ss && next_ss->magic == SUPERSLAB_MAGIC) ? slab_index_for(next_ss, raw_next) : -1;
uint8_t next_meta_cls = (next_idx >= 0 && next_idx < next_cap) ? next_ss->slabs[next_idx].class_idx : 0xff;
if (!next_ss || next_ss->magic != SUPERSLAB_MAGIC || next_idx < 0 || next_idx >= next_cap || next_meta_cls != (uint8_t)class_idx) {
static _Atomic uint32_t g_next_invalid = 0;
uint32_t shot = atomic_fetch_add_explicit(&g_next_invalid, 1, memory_order_relaxed);
if (shot < 8) {
fprintf(stderr,
"[TLS_SLL_NEXT_INVALID] cls=%d next=%p meta_cls=%u idx=%d ss=%p from_base=%p head=%p last_writer=%s\n",
class_idx,
raw_next,
(unsigned)next_meta_cls,
next_idx,
(void*)next_ss,
raw_base,
HAK_BASE_TO_RAW(g_tls_sll[class_idx].head),
g_tls_sll_last_writer[class_idx] ? g_tls_sll_last_writer[class_idx] : "(null)");
}
// Drop remainder of list to avoid chasing stale pointers.
next = HAK_BASE_FROM_RAW(NULL);
tls_sll_set_head(class_idx, next, "pop_next_invalid");
g_tls_sll[class_idx].count = 0;
}
}
#if !HAKMEM_BUILD_RELEASE
if (!hak_base_is_null(next) && !validate_ptr_range(raw_next, "tls_sll_pop_next")) {
fprintf(stderr,
@ -756,15 +899,14 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
}
#endif
g_tls_sll[class_idx].head = next;
tls_sll_record_writer(class_idx, "pop");
tls_sll_set_head_from(class_idx, next, raw_base, where ? where : "pop");
if ((class_idx == 4 || class_idx == 6) && !hak_base_is_null(next) && !tls_sll_head_valid(next)) {
fprintf(stderr, "[TLS_SLL_POP_POST_INVALID] cls=%d next=%p last_writer=%s\n",
class_idx,
raw_next,
g_tls_sll_last_writer[class_idx] ? g_tls_sll_last_writer[class_idx] : "(null)");
tls_sll_dump_tls_window(class_idx, "pop_post");
g_tls_sll[class_idx].head = HAK_BASE_FROM_RAW(NULL);
tls_sll_set_head(class_idx, HAK_BASE_FROM_RAW(NULL), "pop_post");
g_tls_sll[class_idx].count = 0;
return false;
}
@ -775,6 +917,14 @@ static inline bool tls_sll_pop_impl(int class_idx, hak_base_ptr_t* out, const ch
// Clear next inside popped node to avoid stale-chain issues.
tiny_next_write(class_idx, raw_base, NULL);
// Release SuperSlab pin now that node left TLS SLL
do {
SuperSlab* ss_pop = hak_super_lookup(raw_base);
if (ss_pop && ss_pop->magic == SUPERSLAB_MAGIC) {
superslab_ref_dec(ss_pop);
}
} while (0);
#if !HAKMEM_BUILD_RELEASE
// Trace TLS SLL pop (debug only)
extern void ptr_trace_record_impl(int event, void* ptr, int class_idx, uint64_t op_num,
@ -874,8 +1024,7 @@ static inline uint32_t tls_sll_splice(int class_idx,
tls_sll_debug_guard(class_idx, tail, "splice_tail");
PTR_NEXT_WRITE("tls_splice_link", class_idx, HAK_BASE_TO_RAW(tail), 0, HAK_BASE_TO_RAW(g_tls_sll[class_idx].head));
g_tls_sll[class_idx].head = chain_head;
tls_sll_record_writer(class_idx, "splice");
tls_sll_set_head(class_idx, chain_head, "splice");
g_tls_sll[class_idx].count = cur + moved;
return moved;