tomoaki/hakmem
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
3ad1e4c3fe34d168e4526f5d7a85baf6645fb8d4
hakmem/core/box
History
Moe Charm (CI) 8b67718bf2 Fix C7 TLS SLL corruption: Protect next pointer from user data overwrites 
## Root Cause
C7 (1024B allocations, 2048B stride) was using offset=1 for freelist next
pointers, storing them at `base[1..8]`. Since user pointer is `base+1`, users
could overwrite the next pointer area, corrupting the TLS SLL freelist.

## The Bug Sequence
1. Block freed → TLS SLL push stores next at `base[1..8]`
2. Block allocated → User gets `base+1`, can modify `base[1..2047]`
3. User writes data → Overwrites `base[1..8]` (next pointer area!)
4. Block freed again → tiny_next_load() reads garbage from `base[1..8]`
5. TLS SLL head becomes invalid (0xfe, 0xdb, 0x58, etc.)

## Why This Was Reverted
Previous fix (C7 offset=0) was reverted with comment:
  "C7も header を保持して class 判別を壊さないことを優先"
  (Prioritize preserving C7 header to avoid breaking class identification)

This reasoning was FLAWED because:
- Header IS restored during allocation (HAK_RET_ALLOC), not freelist ops
- Class identification at free time reads from ptr-1 = base[0] (after restoration)
- During freelist, header CAN be sacrificed (not visible to user)
- The revert CREATED the race condition by exposing base[1..8] to user

## Fix Applied

### 1. Revert C7 offset to 0 (tiny_nextptr.h:54)
```c
// BEFORE (BROKEN):
return (class_idx == 0) ? 0u : 1u;

// AFTER (FIXED):
return (class_idx == 0 || class_idx == 7) ? 0u : 1u;
```

### 2. Remove C7 header restoration in freelist (tiny_nextptr.h:84)
```c
// BEFORE (BROKEN):
if (class_idx != 0) {  // Restores header for all classes including C7

// AFTER (FIXED):
if (class_idx != 0 && class_idx != 7) {  // Only C1-C6 restore headers
```

### 3. Bonus: Remove premature slab release (tls_sll_drain_box.h:182-189)
Removed `shared_pool_release_slab()` call from drain path that could cause
use-after-free when blocks from same slab remain in TLS SLL.

## Why This Fix Works

**Memory Layout** (C7 in freelist):
```
Address:     base      base+1        base+2048
            ┌────┬──────────────────────┐
Content:    │next│  (user accessible)  │
            └────┴──────────────────────┘
            8B ptr  ← USER CANNOT TOUCH base[0]
```

- **Next pointer at base[0]**: Protected from user modification ✓
- **User pointer at base+1**: User sees base[1..2047] only ✓
- **Header restored during allocation**: HAK_RET_ALLOC writes 0xa7 at base[0] ✓
- **Class ID preserved**: tiny_region_id_read_header(ptr) reads ptr-1 = base[0] ✓

## Verification Results

### Before Fix
- **Errors**: 33 TLS_SLL_POP_INVALID per 100K iterations (0.033%)
- **Performance**: 1.8M ops/s (corruption caused slow path fallback)
- **Symptoms**: Invalid TLS SLL heads (0xfe, 0xdb, 0x58, 0x80, 0xc2, etc.)

### After Fix
- **Errors**: 0 per 200K iterations ✅
- **Performance**: 10.0M ops/s (+456%!) ✅
- **C7 direct test**: 5.5M ops/s, 100K iterations, 0 errors ✅

## Files Modified
- core/tiny_nextptr.h (lines 49-54, 82-84) - C7 offset=0, no header restoration
- core/box/tls_sll_drain_box.h (lines 182-189) - Remove premature slab release

## Architectural Lesson

**Design Principle**: Freelist metadata MUST be stored in memory NOT accessible to user.

| Class | Offset | Next Storage | User Access | Result |
|-------|--------|--------------|-------------|--------|
| C0 | 0 | base[0] | base[1..7] | Safe ✓ |
| C1-C6 | 1 | base[1..8] | base[1..N] | Safe (header at base[0]) ✓ |
| C7 (broken) | 1 | base[1..8] | base[1..2047] | **CORRUPTED** ✗ |
| C7 (fixed) | 0 | base[0] | base[1..2047] | Safe ✓ |

🧹 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-21 23:42:43 +09:00
..
ace_pool_connector.c
Tiny: fix header/stride mismatch and harden refill paths
2025-11-09 18:55:50 +09:00
ace_pool_connector.h
Tiny: fix header/stride mismatch and harden refill paths
2025-11-09 18:55:50 +09:00
adopt_gate_box.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
bench_fast_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
bench_fast_box.h
Phase 20-2: BenchFast mode - Structural bottleneck analysis (+4.5% ceiling)
2025-11-16 06:36:02 +09:00
capacity_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
capacity_box.d
Phase E3-FINAL: Fix Box API offset bugs - ALL classes now use correct offsets
2025-11-13 06:50:20 +09:00
capacity_box.h
Box API Phase 1-3: Capacity Manager, Carve-Push, Prewarm 実装
2025-11-13 01:45:30 +09:00
carve_push_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
carve_push_box.d
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
carve_push_box.h
Box API Phase 1-3: Capacity Manager, Carve-Push, Prewarm 実装
2025-11-13 01:45:30 +09:00
external_guard_box.h
Phase 3d-A: SlabMeta Box boundary - Encapsulate SuperSlab metadata access
2025-11-20 02:01:52 +09:00
free_local_box.c
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
free_local_box.d
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
free_local_box.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
free_publish_box.c
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
free_publish_box.d
Phase12 debug: restore SUPERSLAB constants/APIs, implement Box2 drain boundary, fix tiny_fast_pop to return BASE, honor TLS SLL toggle in alloc/free fast paths, add fail-fast stubs, and quiet capacity sentinel. Update CURRENT_TASK with A/B results (SLL-off stable; SLL-on crash).
2025-11-14 01:02:00 +09:00
free_publish_box.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
free_remote_box.c
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
free_remote_box.d
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
free_remote_box.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
front_gate_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
front_gate_box.d
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
front_gate_box.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
front_gate_classifier.c
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
front_gate_classifier.d
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
front_gate_classifier.h
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
front_gate_v2.h
Phase 15: Box Separation (partial) - Box headers completed, routing deferred
2025-11-15 22:08:51 +09:00
front_metrics_box.c
Phase 19 & 20-1: Frontend optimization + TLS cache prewarm (+16.2% total)
2025-11-16 05:48:59 +09:00
front_metrics_box.d
Phase 21-1-B: Ring cache Alloc/Free 統合 - C2/C3 hot path integration
2025-11-16 07:51:37 +09:00
front_metrics_box.h
Phase 19 & 20-1: Frontend optimization + TLS cache prewarm (+16.2% total)
2025-11-16 05:48:59 +09:00
hak_alloc_api.inc.h
Phase 17-1: Small-Mid Allocator - TLS Frontend Cache (結果: ±0.3%, 層分離成功)
2025-11-16 02:37:24 +09:00
hak_core_init.inc.h
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
hak_exit_debug.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
hak_free_api.inc.h
Phase 15: Box BenchMeta separation + ExternalGuard debug + investigation report
2025-11-15 23:00:21 +09:00
hak_kpi_util.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
hak_wrappers.inc.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
integrity_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
integrity_box.d
Add Box I (Integrity), Box E (Expansion), and comprehensive P0 debugging infrastructure
2025-11-12 02:45:00 +09:00
integrity_box.h
Add Box I (Integrity), Box E (Expansion), and comprehensive P0 debugging infrastructure
2025-11-12 02:45:00 +09:00
mailbox_box.c
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
mailbox_box.d
Phase12 debug: restore SUPERSLAB constants/APIs, implement Box2 drain boundary, fix tiny_fast_pop to return BASE, honor TLS SLL toggle in alloc/free fast paths, add fail-fast stubs, and quiet capacity sentinel. Update CURRENT_TASK with A/B results (SLL-off stable; SLL-on crash).
2025-11-14 01:02:00 +09:00
mailbox_box.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pagefault_telemetry_box.c
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
pagefault_telemetry_box.d
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
pagefault_telemetry_box.h
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
pool_api.inc.h
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
pool_core_api.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_init_api.inc.h
release: silence runtime logs and stabilize benches
2025-11-11 01:47:06 +09:00
pool_mf2_adoption.inc.h
Phase 1: Box Theory refactoring + include reduction
2025-11-06 21:54:12 +09:00
pool_mf2_core.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_mf2_helpers.inc.h
Phase 1: Box Theory refactoring + include reduction
2025-11-06 21:54:12 +09:00
pool_mf2_types.inc.h
Phase 1: Box Theory refactoring + include reduction
2025-11-06 21:54:12 +09:00
pool_mid_desc.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_mid_tc.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_refill.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_stats.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_tls_core.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_tls_ring.inc.h
CRITICAL FIX: TLS 未初期化による 4T SEGV を完全解消
2025-11-07 01:27:04 +09:00
pool_tls_types.inc.h
Phase 1: Box Theory refactoring + include reduction
2025-11-06 21:54:12 +09:00
prewarm_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
prewarm_box.d
Phase12 debug: restore SUPERSLAB constants/APIs, implement Box2 drain boundary, fix tiny_fast_pop to return BASE, honor TLS SLL toggle in alloc/free fast paths, add fail-fast stubs, and quiet capacity sentinel. Update CURRENT_TASK with A/B results (SLL-off stable; SLL-on crash).
2025-11-14 01:02:00 +09:00
prewarm_box.h
Box API Phase 1-3: Capacity Manager, Carve-Push, Prewarm 実装
2025-11-13 01:45:30 +09:00
ptr_conversion_box.h
Phase E3-FINAL: Fix Box API offset bugs - ALL classes now use correct offsets
2025-11-13 06:50:20 +09:00
ss_ace_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_ace_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_allocation_box.c
Fix C0/C7 class confusion: Upgrade C7 stride to 2048B and fix meta->class_idx initialization
2025-11-21 13:44:05 +09:00
ss_allocation_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_cache_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_cache_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_hot_cold_box.h
Phase 12-1.1: EMPTY Slab Detection + Immediate Reuse (+13% improvement, 10.2M→11.5M ops/s)
2025-11-21 04:56:48 +09:00
ss_hot_prewarm_box.c
Phase 26: Front Gate Unification - Tiny allocator fast path (+12.9%)
2025-11-17 05:29:08 +09:00
ss_hot_prewarm_box.d
Phase 21-1-B: Ring cache Alloc/Free 統合 - C2/C3 hot path integration
2025-11-16 07:51:37 +09:00
ss_hot_prewarm_box.h
Phase 19 & 20-1: Frontend optimization + TLS cache prewarm (+16.2% total)
2025-11-16 05:48:59 +09:00
ss_legacy_backend_box.c
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
ss_legacy_backend_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_os_acquire_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_os_acquire_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_slab_management_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_slab_management_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_slab_meta_box.h
Phase 3d-A: SlabMeta Box boundary - Encapsulate SuperSlab metadata access
2025-11-20 02:01:52 +09:00
ss_stats_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_stats_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
ss_unified_backend_box.c
Fix C0/C7 class confusion: Upgrade C7 stride to 2048B and fix meta->class_idx initialization
2025-11-21 13:44:05 +09:00
ss_unified_backend_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
superslab_expansion_box.c
Fix C0/C7 class confusion: Upgrade C7 stride to 2048B and fix meta->class_idx initialization
2025-11-21 13:44:05 +09:00
superslab_expansion_box.d
Phase12 debug: restore SUPERSLAB constants/APIs, implement Box2 drain boundary, fix tiny_fast_pop to return BASE, honor TLS SLL toggle in alloc/free fast paths, add fail-fast stubs, and quiet capacity sentinel. Update CURRENT_TASK with A/B results (SLL-off stable; SLL-on crash).
2025-11-14 01:02:00 +09:00
superslab_expansion_box.h
Add Box I (Integrity), Box E (Expansion), and comprehensive P0 debugging infrastructure
2025-11-12 02:45:00 +09:00
tiny_near_empty_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
tiny_near_empty_box.d
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
tiny_near_empty_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
tiny_next_ptr_box.h
Fix C0/C7 class confusion: Upgrade C7 stride to 2048B and fix meta->class_idx initialization
2025-11-21 13:44:05 +09:00
tiny_sizeclass_hist_box.c
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
tiny_sizeclass_hist_box.d
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
tiny_sizeclass_hist_box.h
Phase 3d-B: TLS Cache Merge - Unified g_tls_sll[] structure (+12-18% expected)
2025-11-20 07:32:30 +09:00
tls_sll_box.h
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
tls_sll_drain_box.h
Fix C7 TLS SLL corruption: Protect next pointer from user data overwrites
2025-11-21 23:42:43 +09:00
unified_batch_box.c
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00
unified_batch_box.d
Code Cleanup: Remove false positives, redundant validations, and reduce verbose logging
2025-11-21 23:00:24 +09:00
unified_batch_box.h
Phase 23 Unified Cache + PageFaultTelemetry generalization: Mid/VM page-fault bottleneck identified
2025-11-17 02:47:58 +09:00