[PATCH v12 1/2] malloc: add tcache support for large chunk caching

[Cupertino Miranda]

Hi Florian.

Thanks for notifying me on this.
I will look it up immediately.

Cheers,
Cupertino

On 08-07-2025 15:48, Florian Weimer wrote:
> * Cupertino Miranda:
> 
>> Existing tcache implementation in glibc seems to focus in caching
>> smaller data size allocations, limiting the size of the allocation to
>> 1KB.
>>
>> This patch changes tcache implementation to allow to cache any chunk
>> size allocations.  The implementation adds extra bins (linked-lists)
>> which store chunks with different ranges of allocation sizes. Bin
>> selection is done in multiples in powers of 2 and chunks are inserted in
>> growing size ordering within the bin.  The last bin contains all other
>> sizes of allocations.
>>
>> This patch although by default preserves the same implementation,
>> limitting caches to 1KB chunks, it now allows to increase the max size
>> for the cached chunks with the tunable glibc.malloc.tcache_max.
>>
>> It also now verifies if chunk was mmapped, in which case __libc_free
>> will not add it to tcache.
> 
> This change appears to cause heap corruption in the default
> configuration:
> 
>    glibc: tcache support for large chunk caching is broken
>    <https://bugzilla.redhat.com/show_bug.cgi?id=2377132>
> 
> It reproduces on Fedora 42 with glibc built upstream sources, like this:
> 
> while bash `pwd`/testrun.sh /usr/bin/scanimage --verbose --device=test --batch-count=2; do :; done
> 
> I tried to track it down further.  Even if I fix things up so that I can
> build with !USE_TCACHE, and even then, the bug reproduces.  So some size
> calculation is probably off somewhere.
> 
> Thanks,
> Florian
>