[PATCH v4 COMMITTED] malloc: Prevent arena free_list from turning cyclic [BZ #19048]

[Florian Weimer]

On 10/28/2015 07:42 AM, Carlos O'Donell wrote:

>> diff --git a/NEWS b/NEWS
>> index 00e3b03..d4a7863 100644
>> --- a/NEWS
>> +++ b/NEWS
>> @@ -19,9 +19,9 @@ Version 2.23
>>    18857, 18863, 18870, 18872, 18873, 18875, 18887, 18918, 18921, 18928,
>>    18951, 18952, 18953, 18956, 18961, 18966, 18967, 18969, 18970, 18977,
>>    18980, 18981, 18982, 18985, 19003, 19007, 19012, 19016, 19018, 19032,
>> -  19046, 19049, 19050, 19059, 19071, 19074, 19076, 19077, 19078, 19079,
>> -  19085, 19086, 19088, 19094, 19095, 19124, 19125, 19129, 19134, 19137,
>> -  19156.
>> +  19046, 19048, 19049, 19050, 19059, 19071, 19074, 19076, 19077, 19078,
>> +  19079, 19085, 19086, 19088, 19094, 19095, 19124, 19125, 19129, 19134,
>> +  19137, 19156.
> 
> Please keep NEWS out of the diff. It makes it easier to use cli pwclient
> to fetch and apply patch without needing a merge driver. We'll soon do away
> with this requirement by automating the generation of the list from bugzilla.

Okay, I will try to remember that.

> Should we add a NEWS item to highlight the behavioural change in malloc?


> Why check `result != NULL`?
> 
> if (replaced_arena != NULL)
>   detach_arena (replaced_arena);
> 
> ?

Oops.

There is already a check in detach_arena, so I removed the condition.

> I wouldn't expect thread_arena to ever be NULL, so it seems
> like we should be able to just write:
> 
> deatch_arena (replaced_arena);
> 
> and be done.

I assume replaced_arena could be NULL if the first arena is attached to
the thread.

I'm attaching what I've committed.  I have backported this to Fedora 22,
and the desktop environment still works.

Florian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-malloc-Prevent-arena-free_list-from-turning-cyclic-B.patch
Type: text/x-patch
Size: 7287 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20151028/7987cb04/attachment.bin>