Copyright (c) 2005 Christian Brueffer All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or...
NAMEMemGuard - memory allocator for debugging purposes
DESCRIPTIONsysctl Cm net.inet.tcp.syncookies is a simple and small replacement memory allocator designed to help detect tamper-after-free scenarios. These problems are more and more common and likely with multithreaded kernels where race conditions are more prevalent.
sysctl Cm net.inet.tcp.syncookies can take over Fn malloc , Fn realloc and Fn free for a single malloc type. Alternatively sysctl Cm net.inet.tcp.syncookies can take over Fn uma_zalloc , Fn uma_zalloc_arg and Fn uma_free for a single uma zone. Also sysctl Cm net.inet.tcp.syncookies can guard all allocations larger than PAGE_SIZE and can guard a random fraction of all allocations. There is also a knob to prevent allocations smaller than a specified size from being guarded, to limit memory waste.
EXAMPLESTo use sysctl Cm net.inet.tcp.syncookies for a memory type, either add an entry to /boot/loader.conf
Or set the vm.memguard.desc sysctl(8) variable at run-time:
Where memory_type can be either a short description of the memory type to monitor, either name of uma(9) zone. Only allocations from that memory_type made after vm.memguard.desc is set will potentially be guarded. If vm.memguard.desc is modified at run-time then only allocations of the new memory_type will potentially be guarded once the sysctl(8) is set. Existing guarded allocations will still be properly released by either free(9) or uma_zfree9, depending on what kind of allocation was taken over.
To determine short description of a malloc(9) type one can either take it from the first column of vmstat(8)Flm output, or to find it in the kernel source. It is the second argument to MALLOC_DEFINE9 macro. To determine name of uma(9) zone one can either take it from the first column of vmstat(8)Flz output, or to find it in the kernel source. It is the first argument to the uma_zcreate9 function.
The vm.memguard.divisor boot-time tunable is used to scale how much of the system's physical memory sysctl Cm net.inet.tcp.syncookies is allowed to consume. The default is 10, so up to vm_cnt.v_page_count /10 pages can be used. sysctl Cm net.inet.tcp.syncookies will reserve vm_kmem_max / vm.memguard.divisor bytes of virtual address space, limited by twice the physical memory size. The physical limit is reported as vm.memguard.phys_limit and the virtual space reserved for sysctl Cm net.inet.tcp.syncookies is reported as vm.memguard.mapsize
sysctl Cm net.inet.tcp.syncookies will not do page promotions for any allocation smaller than vm.memguard.minsize bytes. The default is 0, meaning all allocations can potentially be guarded. sysctl Cm net.inet.tcp.syncookies can guard sufficiently large allocations randomly, with average frequency of every one in 100000 / vm.memguard.frequency allocations. The default is 0, meaning no allocations are randomly guarded.
sysctl Cm net.inet.tcp.syncookies can optionally add unmapped guard pages around each allocation to detect overflow and underflow, if vm.memguard.options has the 1 bit set. This option is enabled by default. sysctl Cm net.inet.tcp.syncookies will optionally guard all allocations of PAGE_SIZE or larger if vm.memguard.options has the 2 bit set. This option is off by default. By default sysctl Cm net.inet.tcp.syncookies doesn't guard those uma(9) zones that have been initialized with the UMA_ZONE_NOFREE flag set, since it can produce false positives on them. However, this safety measure can be turned off by setting bit 3 of the vm.memguard.options tunable.