[PATCH v12 1/2] malloc: add tcache support for large chunk caching

[Florian Weimer]

* Cupertino Miranda:

> Existing tcache implementation in glibc seems to focus in caching
> smaller data size allocations, limiting the size of the allocation to
> 1KB.
>
> This patch changes tcache implementation to allow to cache any chunk
> size allocations.  The implementation adds extra bins (linked-lists)
> which store chunks with different ranges of allocation sizes. Bin
> selection is done in multiples in powers of 2 and chunks are inserted in
> growing size ordering within the bin.  The last bin contains all other
> sizes of allocations.
>
> This patch although by default preserves the same implementation,
> limitting caches to 1KB chunks, it now allows to increase the max size
> for the cached chunks with the tunable glibc.malloc.tcache_max.
>
> It also now verifies if chunk was mmapped, in which case __libc_free
> will not add it to tcache.

This change appears to cause heap corruption in the default
configuration:

  glibc: tcache support for large chunk caching is broken
  <https://bugzilla.redhat.com/show_bug.cgi?id=2377132>

It reproduces on Fedora 42 with glibc built upstream sources, like this:

while bash `pwd`/testrun.sh /usr/bin/scanimage --verbose --device=test --batch-count=2; do :; done

I tried to track it down further.  Even if I fix things up so that I can
build with !USE_TCACHE, and even then, the bug reproduces.  So some size
calculation is probably off somewhere.

Thanks,
Florian