[PATCH] malloc: Make sure tcache_key is odd enough

[Samuel Thibault]

We want tcache_key not to be a commonly-occurring value in memory, so ensure
a minimum amount of one and zero bits.

And we need it is non-zero, otherwise even if tcache_double_free_verify sets
e->key to 0 before calling __libc_free, it gets called again by __libc_free,
thus looping indefinitely.

Fixes: c968fe50628db74b52124d863cd828225a1d305c ("malloc: Use tailcalls in __libc_free")
---
 malloc/malloc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 5ca390cc22..9c3d0cfda3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3152,6 +3152,15 @@ tcache_key_initialize (void)
   if (__getrandom_nocancel_nostatus_direct (&tcache_key, sizeof(tcache_key),
 					    GRND_NONBLOCK)
       != sizeof (tcache_key))
+    tcache_key = 0;
+
+  /* We want tcache_key not to be a commonly-occurring value in memory, so
+   * ensure a minimum amount of one and zero bits.  */
+  int minimum_bits = __WORDSIZE * 3 / 8;
+  int maximum_bits = __WORDSIZE - minimum_bits;
+
+  while (__builtin_popcountl (tcache_key) < minimum_bits
+      || __builtin_popcountl (tcache_key) > maximum_bits)
     {
       tcache_key = random_bits ();
 #if __WORDSIZE == 64
-- 
2.47.2