[PATCH] malloc: check tcache mem size in tcache_get_n to avoid arbitrary mem allocation

[dbgbgtf]

Sorry for the earlier emails, I didn't know the rules and open too many
email threads, I will reply to this email in the future.

Get the request size by tc_idx, and then compare request size with the
mem size.

Also remove the align and size check when fastbin stashing into
tcachebin, since the tcache has these two checks already.

In bench-malloc-thread, my patch will be 3% slower.
In bench-malloc-simple-4096, my patch will be 0.5% slower.
So i guess that is acceptable?

My patch result from bench-malloc-thread and bench-malloc-simple-4096

"duration": 3.19901e+11,
"iterations": 1.02021e+10,
"time_per_iteration": 31.3563,
"max_rss": 6476,
"threads": 32,

"thread_arena__allocs_1600_time": 892.826

The result from the lastest branch

"duration": 3.19966e+11,
"iterations": 1.05894e+10,
"time_per_iteration": 30.2158,
"max_rss": 6908,
"threads": 32,

"thread_arena__allocs_1600_time": 887.952

Signed-off-by: dbgbgtf <dudududuMaxVer@gmail.com>
---
 malloc/malloc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index a0bc733482..3c2754d3d1 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -297,6 +297,9 @@
 /* Only used to pre-fill the tunables.  */
 # define tidx2usize(idx)	(((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ)
 
+/* tc_idx to chunksize */
+# define tidx2csize(idx)    (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE)
+
 /* When "x" is from chunksize().  */
 # define csize2tidx(x) (((x) - MINSIZE) / MALLOC_ALIGNMENT)
 /* When "x" is a user-provided size.  */
@@ -3186,6 +3189,8 @@ tcache_get_n (size_t tc_idx, tcache_entry **ep)
 
   if (__glibc_unlikely (!aligned_OK (e)))
     malloc_printerr ("malloc(): unaligned tcache chunk detected");
+  if (__glibc_unlikely (tidx2csize(tc_idx) != chunksize (mem2chunk(e))))
+    malloc_printerr ("malloc(): tcache mem size vs request size");
 
   if (ep == &(tcache->entries[tc_idx]))
       *ep = REVEAL_PTR (e->next);
@@ -4009,11 +4014,6 @@ _int_malloc (mstate av, size_t bytes)
 		  while (tcache->counts[tc_idx] < mp_.tcache_count
 			 && (tc_victim = *fb) != NULL)
 		    {
-		      if (__glibc_unlikely (misaligned_chunk (tc_victim)))
-			malloc_printerr ("malloc(): unaligned fastbin chunk detected 3");
-		      size_t victim_tc_idx = csize2tidx (chunksize (tc_victim));
-		      if (__glibc_unlikely (tc_idx != victim_tc_idx))
-			malloc_printerr ("malloc(): chunk size mismatch in fastbin");
 		      if (SINGLE_THREAD_P)
 			*fb = REVEAL_PTR (tc_victim->fd);
 		      else
-- 
2.49.0