diff options
| author | Michael Anthony Knyszek <mknyszek@google.com> | 2020-03-28 16:11:15 +0000 |
|---|---|---|
| committer | Michael Knyszek <mknyszek@google.com> | 2020-03-30 14:30:38 +0000 |
| commit | 89e13c88e4f9f3a3eea7bf105e5af475727a4c33 (patch) | |
| tree | 2ba78b593c50a514f920985cb66f60d9750fcad6 /src/runtime/mpagecache.go | |
| parent | 0b7c202e98949b530f7f4011efd454164356ba69 (diff) | |
| download | go-89e13c88e4f9f3a3eea7bf105e5af475727a4c33.tar.gz go-89e13c88e4f9f3a3eea7bf105e5af475727a4c33.zip | |
runtime: check the correct sanity condition in the page allocator
Currently there are a few sanity checks in the page allocator which
should fail immediately but because it's a check for a negative number
on a uint, it's actually dead-code.
If there's a bug in the page allocator which would cause the sanity
check to fail, this could cause memory corruption by returning an
invalid address (more precisely, one might either see a segfault, or
span overlap).
This change fixes these sanity checks to check the correct condition.
Fixes #38130.
Change-Id: Ia19786cece783d39f26df24dec8788833a6a3f21
Reviewed-on: https://go-review.googlesource.com/c/go/+/226297
Reviewed-by: Giovanni Bajo <rasky@develer.com>
Reviewed-by: Cherry Zhang <cherryyz@google.com>
Diffstat (limited to 'src/runtime/mpagecache.go')
| -rw-r--r-- | src/runtime/mpagecache.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/runtime/mpagecache.go b/src/runtime/mpagecache.go index 9fc338bd8e..5b679d357d 100644 --- a/src/runtime/mpagecache.go +++ b/src/runtime/mpagecache.go @@ -115,7 +115,7 @@ func (s *pageAlloc) allocToCache() pageCache { // Fast path: there's free pages at or near the searchAddr address. chunk := s.chunkOf(ci) j, _ := chunk.find(1, chunkPageIndex(s.searchAddr)) - if j < 0 { + if j == ^uint(0) { throw("bad summary data") } c = pageCache{ |