[PATCH 01/16] malloc: Fix a realloc crash with heap tagging [BZ 27468]

[Wilco Dijkstra]

Hi DJ,

>> +	  size_t sz = CHUNK_AVAILABLE_SIZE (oldp) - CHUNK_HDR_SZ;
>
> I think this is semantically wrong, because the chunk size
> (mptr->mchunk_size) does not include the mchunk_prev_size that's
> accounted for in CHUNK_HDR_SZ.  I suspect the problem is that
> CHUNK_AVAILABLE_SIZE is wrong, in that it adds SIZE_SZ in the non-tagged
> case, and shouldn't, or that it's defined (or named) wrong.

CHUNK_AVAILABLE_SIZE is badly named, but it is the total chunksize plus
the extra SIZE_SZ word in the next non-mmap chunk. With memory tagging
you can't use the extra word in the next chunk either. Note that most existing
uses of it explicitly subtract CHUNK_HDR_SZ to get the user size of the chunk.

What would be better is to add CHUNK_USABLE_SIZE or CHUNK_DATA_SIZE which
returns size you can actually use for data and remove CHUNK_AVAILABLE_SIZE.

Cheers,
Wilco