Memory allocation errors

Richard B. Johnson (root@analogic.com)
Tue, 28 Jan 1997 09:36:19 -0500 (EST)


>From info received here, I decided to make my own check of a possible
memory allocation bug. I can confirm that the bug does, indeed, exist.

Given the following program which allocates memory, writes to it, then
FREES it, the system runs out of memory...........

--------------------------
#include <stdio.h>
#include <malloc.h>
#include <unistd.h>

#define HUGE 30000000
int main(void);
int main()
{
int i;
char *ptr;
if(fork()) return 0;
(void) close(0);
(void) close(1);
(void) close(2);
if((ptr = (char *) malloc(HUGE * sizeof(char))) == NULL)
return(0);
for(i=0; i< HUGE; i++)
ptr[i]= (char) (i & 0xff);
free(ptr);
pause();
return 0;
}

-----------------------------------------

Three copies running (but suspended) ..........

100040 0 9915 1 0 0 30184 1704 pause S 1 0:04 ./mem
100040 0 9919 1 0 0 30184 4324 pause S 1 0:03 ./mem
100040 0 9937 1 0 0 30184 13376 pause S 1 0:04 ./mem

Memory in use before execution.

total: used: free: shared: buffers: cached:
Mem: 31461376 9220096 22241280 1572864 491520 3747840
Swap: 74022912 0 74022912
MemTotal: 30724 kB
MemFree: 21720 kB
MemShared: 1536 kB
Buffers: 480 kB
Cached: 3660 kB
SwapTotal: 72288 kB
SwapFree: 72288 kB

Memory now in use, even though it was freed.

total: used: free: shared: buffers: cached:
Mem: 31461376 25944064 5517312 1691648 360448 2883584
Swap: 74022912 73195520 827392
MemTotal: 30724 kB
MemFree: 5388 kB
MemShared: 1652 kB
Buffers: 352 kB
Cached: 2816 kB
SwapTotal: 72288 kB
SwapFree: 808 kB

Attempt to do some work using memory.........

Log from compiling kernel.

floppy.c: In function `make_raw_rw_request':
floppy.c:2684: virtual memory exhausted <---------------- !!!!!
cpp: output pipe has been closed
make[3]: *** [floppy.o] Error 1
make[3]: Leaving directory `/usr/src/linux-2.1.23/drivers/block'
make[2]: *** [first_rule] Error 2
make[2]: Leaving directory `/usr/src/linux-2.1.23/drivers/block'
make[1]: *** [sub_dirs] Error 2
make[1]: Leaving directory `/usr/src/linux-2.1.23/drivers'
make: *** [linuxsubdirs] Error 2

It appears as though freeing memory through the 'C' runtime library
doesn't free memory at all. This may not be a kernel bug because memory
is truly freed once the process exits. Something is wrong with free()!

This could be a disaster in the making. This might be the reason
for some "memory leaks" reported by those who keep their systems
up running servers for long periods of time.

Now a simple modification to the program lets it run forever. To me
this means that "free()" _IS_ freeing it's pointers from the heap, but
the heap itself is never being freed. When the last allocated memory
is freed, free() MUST deallocate the heap at the break addresses that
it MUST have kept track of. If not, this is what happens.

This will run forever........

#include <stdio.h>
#include <malloc.h>
#include <unistd.h>

#define HUGE 30000000
int main(void);
int main()
{
int i;
char *ptr;
if(fork()) return 0;
(void) close(0);
(void) close(1);
(void) close(2);
for(;;)
{
if((ptr = (char *) malloc(HUGE * sizeof(char))) == NULL)
return(0);
for(i=0; i< HUGE; i++)
ptr[i]= (char) (i & 0xff);
free(ptr);
sleep(1);
}
return 0;
}

I can run the first program forever on my Sun (SunOS 5.5.1). This
machine, in spite of its many problems, does deallocate RAM when
free() is called.

Whomever is maintaining the 'C' runtime library should fix this. This
is a disaster lurking in the shadows.

Cheers,
Dick Johnson
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Richard B. Johnson
Project Engineer
Analogic Corporation
Voice : (508) 977-3000 ext. 3754
Fax : (508) 532-6097
Modem : (508) 977-6870
Ftp : ftp@boneserver.analogic.com
Email : rjohnson@analogic.com, johnson@analogic.com
Penguin : Linux version 2.1.23 on an i586 machine (66.15 BogoMips).
Warning : It's hard to remain at the trailing edge of technology.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-