[PATCH][BZ #12140] Add note on free list pointers overwritingM_PERTURB bytes

[Siddhesh Poyarekar <siddhesh at redhat dot com>]

Hi,

M_PERTURB causes malloc and free to initialize the allocated (and
freed) memory block with a specified byte.  A freed block however, will
not have the perturb pattern in all of the usable malloc area.  This is
because the fd and bk pointers for the free list are within the usable
area due to which the initial portion of the usable area may get
overwritten.

In fact, as the reproducer in the bug report above shows, the initial
sizeof(void *) bytes will always be overwritten since p->fd is always
set during free of a block on heap.

Attached patch adds a note to the documentation mentioning this so that
someone debugging an application bug exposed by M_PERTURB does not get
confused trying to figure out why the initial part of the block does
not have the perturb pattern.

OK to commit?

Regards,
Siddhesh

ChangeLog:

	[BZ #12140]
	* manual/memory.texi (Malloc Tunable Parameters): Add note
	about free list pointers overwriting some perturb bytes.

diff --git a/manual/memory.texi b/manual/memory.texi
index fba3a2c..ab052ef 100644
--- a/manual/memory.texi
+++ b/manual/memory.texi
@@ -706,7 +706,9 @@ to zero disables all use of @code{mmap}.
 If non-zero, memory blocks are filled with values depending on some
 low order bits of this parameter when they are allocated (except when
 allocated by @code{calloc}) and freed.  This can be used to debug the
-use of uninitialized or freed heap memory.
+use of uninitialized or freed heap memory.  Note that glibc overwrites contents
+of freed blocks with metadata to track them, so the initial bytes in such
+blocks may not have the perturb pattern.
 @end table
 
 @end deftypefun