From: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
Date: Tue, 5 Jul 2016 11:01:15 +0000 (+0100)
Subject: mem: zero out memory on free
X-Git-Url: http://git.droids-corp.org/?p=dpdk.git;a=commitdiff_plain;h=ea0bddbd14e68fb42d9774bc3543e51b510e48d3

mem: zero out memory on free

Since commit fafcc11985a2, memzones are not guaranteed to be zeroed out.
This could potentially cause issues as applications might have been
relying on the allocated memory being zeroed out.

On init all allocated memory is zeroed by the kernel, so by zeroing out
memory on free, all available dpdk memory is always zeroed.

Fixes: fafcc11985a2 ("mem: rework memzone to be allocated by malloc")

Signed-off-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
---

diff --git a/lib/librte_eal/common/malloc_elem.c b/lib/librte_eal/common/malloc_elem.c
index 27e9925dcc..42568e1d7b 100644
--- a/lib/librte_eal/common/malloc_elem.c
+++ b/lib/librte_eal/common/malloc_elem.c
@@ -275,11 +275,14 @@ malloc_elem_free(struct malloc_elem *elem)
 		return -1;
 
 	rte_spinlock_lock(&(elem->heap->lock));
+	size_t sz = elem->size - sizeof(*elem);
+	uint8_t *ptr = (uint8_t *)&elem[1];
 	struct malloc_elem *next = RTE_PTR_ADD(elem, elem->size);
 	if (next->state == ELEM_FREE){
 		/* remove from free list, join to this one */
 		elem_free_list_remove(next);
 		join_elem(elem, next);
+		sz += sizeof(*elem);
 	}
 
 	/* check if previous element is free, if so join with it and return,
@@ -288,15 +291,17 @@ malloc_elem_free(struct malloc_elem *elem)
 	if (elem->prev != NULL && elem->prev->state == ELEM_FREE) {
 		elem_free_list_remove(elem->prev);
 		join_elem(elem->prev, elem);
-		malloc_elem_free_list_insert(elem->prev);
-	}
-	/* otherwise add ourselves to the free list */
-	else {
-		malloc_elem_free_list_insert(elem);
-		elem->pad = 0;
+		sz += sizeof(*elem);
+		ptr -= sizeof(*elem);
+		elem = elem->prev;
 	}
+	malloc_elem_free_list_insert(elem);
+
 	/* decrease heap's count of allocated elements */
 	elem->heap->alloc_count--;
+
+	memset(ptr, 0, sz);
+
 	rte_spinlock_unlock(&(elem->heap->lock));
 
 	return 0;