runtime: remove race and increase precision in pointer validation.

This CL removes the single and racy use of mheap.arena_end outside
of the bookkeeping done in mHeap_init and mHeap_Alloc.
There should be no way for heapBitsForSpan to see a pointer to
an invalid span. This CL makes the check for this more precise by
checking that the pointer is between mheap_.arena_start and
mheap_.arena_used instead of mheap_.arena_end.

Change-Id: I1200b54353ee1eda002d92645fd8d26048600ceb
Reviewed-on: https://go-review.googlesource.com/11342
Reviewed-by: Austin Clements <austin@google.com>

diff --git a/src/runtime/mbitmap.go b/src/runtime/mbitmap.go
index 146ffbfcb601a8a93e0c82150095e32407a30b13..4d39c321d8256b9b1fc54edaa92fe0528d262a68 100644 (file)
--- a/src/runtime/mbitmap.go
+++ b/src/runtime/mbitmap.go
@@ -164,7 +164,7 @@ func heapBitsForAddr(addr uintptr) heapBits {
 
 // heapBitsForSpan returns the heapBits for the span base address base.
 func heapBitsForSpan(base uintptr) (hbits heapBits) {
-       if base < mheap_.arena_start || base >= mheap_.arena_end {
+       if base < mheap_.arena_start || base >= mheap_.arena_used {
                throw("heapBitsForSpan: base out of range")
        }
        hbits = heapBitsForAddr(base)