RFC: malloc fastbin concurrency bug

[Wilco Dijkstra]

Hi,

The fastbin code in _int_malloc seems to have an ABA concurrency bug.
Basically it does 2 racy reads of the fastbin head and next pointer, then
uses a compare-exchange to verify the fastbin head was the right one.
However that ignores that the next pointer may have changed inbetween:

victim = *fb;                  // racy read of fastbin head
pp = REVEAL_PTR (victim->fd);  // racy read of next pointer
// another thread may make changes to fb and *fb->next at this point
if (atomic_compare_exchange_acquire (fb, &victim, pp))
   // here we have verified the racy read of fb was indeed correct
   // but the next pointer pp may still have changed inbetween!

The victim's next pointer may be changed if another thread pops off victim
and pushes victim again with a different next pointer before the compare-
exchange.

I'm wondering whether there is an easy fix for this - we could check that
pp == REVEAL_PTR (victim->fd) but if that fails we have corrupted the
fastbin list already, so we crash... Any ideas?

Cheers,
Wilco