mem: HG_MALLOC unit tests: exit drain and double free

A process leaving through dynamic_process_final_exit() must give its
cells back (the arena's real_used returns to its baseline); a cell freed
twice in a row and a large fragment freed twice are refused, counted and
never handed out twice.

Author: Lt-Flash

mem/test/test_hg_malloc.c

@@ -331,6 +331,104 @@ static void test_hg_grow(void)
 		shm_free(p[i]);
 }
 
+/*
+ * A process leaving for good (auto-scaling down) must give back what it holds
+ * in the shared arena: its cached cells and the unused rest of the chunks it
+ * carved. The arena's real_used counts whole carved blocks, so it returns to
+ * its baseline only if every block the child touched drained. The size is one
+ * the idle processes of a test run do not use.
+ */
+#define HGT_EXIT_SIZE   20000
+#define HGT_EXIT_CELLS  100
+
+static int hgt_child_exit(void *arg)
+{
+	void *p[HGT_EXIT_CELLS];
+	int i;
+
+	for (i = 0; i < HGT_EXIT_CELLS; i++) {
+		p[i] = shm_malloc(HGT_EXIT_SIZE);
+		if (!p[i]) {
+			LM_ERR("shm_malloc(%d) failed\n", HGT_EXIT_SIZE);
+			return -1;
+		}
+	}
+	for (i = 0; i < HGT_EXIT_CELLS; i++)
+		shm_free(p[i]);
+
+	/* report first: the exit below does not return */
+	*hgt_verdict = HGT_PASS;
+	dynamic_process_final_exit();
+	return 0;
+}
+
+static void test_hg_exit_returns_cells(void)
+{
+	struct hg_block *hb = shm_block;
+	unsigned long base = hb->real_used;
+	int waited;
+
+	if (!hgt_in_child("hg exit", hgt_child_exit, NULL)) {
+		ok(0, "a process leaving for good gives back its cells");
+		return;
+	}
+
+	/* the child gives its cells back right before it exits */
+	for (waited = 0; hb->real_used > base && waited < HGT_WAIT_US;
+	        waited += HGT_STEP_US)
+		usleep(HGT_STEP_US);
+
+	ok(hb->real_used <= base, "a process leaving for good gives back its "
+		"cached cells and unused chunk tails (real_used %lu -> %lu KB)",
+		base >> 10, hb->real_used >> 10);
+}
+
+/*
+ * A double free must be refused and counted, never hand the same memory to
+ * two callers: the same cell freed twice in a row (it stays on the freeing
+ * process's private list, which the shared pool's free map cannot see), and
+ * a large-tier fragment freed twice.
+ */
+static int hgt_child_double_free(void *arg)
+{
+	unsigned long size = (unsigned long)arg;
+	void *p, *a, *b;
+
+	p = shm_malloc(size);
+	if (!p)
+		return -1;
+	shm_free(p);
+	shm_free(p);
+
+	a = shm_malloc(size);
+	b = shm_malloc(size);
+	if (!a || !b || a == b) {
+		LM_ERR("after a double free of %p: two allocations returned %p "
+			"and %p\n", p, a, b);
+		return -1;
+	}
+	shm_free(a);
+	shm_free(b);
+	return 0;
+}
+
+static void test_hg_double_free(void)
+{
+	struct hg_block *hb = shm_block;
+	unsigned long c0;
+
+	c0 = hb->corrupt[HG_C_DOUBLE_FREE];
+	ok(hgt_in_child("hg double free", hgt_child_double_free,
+		(void *)200UL) && hb->corrupt[HG_C_DOUBLE_FREE] == c0 + 1,
+		"a cell freed twice in a row is refused and counted, not handed "
+		"out twice");
+
+	c0 = hb->corrupt[HG_C_DOUBLE_FREE];
+	ok(hgt_in_child("hg large double free", hgt_child_double_free,
+		(void *)(200UL * 1024)) && hb->corrupt[HG_C_DOUBLE_FREE] == c0 + 1,
+		"a large fragment freed twice is refused and counted");
+}
+
 static unsigned long hgt_corruption(void)
 {
 	unsigned long t = hg_corrupt_total((struct hg_block *)shm_block) +
@@ -359,10 +457,14 @@ void test_hg_malloc(void)
 	test_hg_cross_process_shm();
 	test_hg_large();
 	test_hg_grow();
+	test_hg_exit_returns_cells();
 
 	ok(hgt_corruption() == 0, "no corruption detected in the parent's view "
 		"of the shm and pkg arenas");
 
+	/* last: these count a detection on purpose */
+	test_hg_double_free();
+
 	shm_free((void *)hgt_verdict);
 }
 

mem/test/test_hg_malloc.h

@@ -24,7 +24,7 @@
 #define __TEST_HG_MALLOC_H__
 
 /* children forked by test_hg_malloc(), one at a time (pt.c reserves them) */
-#define TEST_HG_MALLOC_PROCS  2
+#define TEST_HG_MALLOC_PROCS  5
 
 /* non-zero when HG_MALLOC (or HG_MALLOC_DBG) serves both pkg and shm */
 int hg_ut_selected(void);