Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion tcmalloc/guarded_page_allocator.cc
Original file line number Diff line number Diff line change
Expand Up @@ -520,7 +520,11 @@ GuardedAllocationsErrorType GuardedPageAllocator::GetErrorType(
if (addr >= d.allocation_start + d.requested_size) {
return GuardedAllocationsErrorType::kBufferOverflow;
}
return GuardedAllocationsErrorType::kUnknown;
// If addr is within [d.allocation_start, d.allocation_start +
// d.requested_size) on a faulted Object Page where dealloc_count == 0,
// metadata was reset by concurrent slot recycling. It is guaranteed to be a
// Use-After-Free.
return GuardedAllocationsErrorType::kUseAfterFree;
}

uintptr_t GuardedPageAllocator::SlotToAddr(size_t slot) const {
Expand Down
Loading