[PATCH v12 1/2] malloc: add tcache support for large chunk caching

[Florian Weimer]

* Florian Weimer:

> * Cupertino Miranda:
>
>> Existing tcache implementation in glibc seems to focus in caching
>> smaller data size allocations, limiting the size of the allocation to
>> 1KB.
>>
>> This patch changes tcache implementation to allow to cache any chunk
>> size allocations.  The implementation adds extra bins (linked-lists)
>> which store chunks with different ranges of allocation sizes. Bin
>> selection is done in multiples in powers of 2 and chunks are inserted in
>> growing size ordering within the bin.  The last bin contains all other
>> sizes of allocations.
>>
>> This patch although by default preserves the same implementation,
>> limitting caches to 1KB chunks, it now allows to increase the max size
>> for the cached chunks with the tunable glibc.malloc.tcache_max.
>>
>> It also now verifies if chunk was mmapped, in which case __libc_free
>> will not add it to tcache.
>
> This change appears to cause heap corruption in the default
> configuration:
>
>   glibc: tcache support for large chunk caching is broken
>   <https://bugzilla.redhat.com/show_bug.cgi?id=2377132>
>
> It reproduces on Fedora 42 with glibc built upstream sources, like this:
>
> while bash `pwd`/testrun.sh /usr/bin/scanimage --verbose --device=test --batch-count=2; do :; done
>
> I tried to track it down further.  Even if I fix things up so that I can
> build with !USE_TCACHE, and even then, the bug reproduces.  So some size
> calculation is probably off somewhere.

Mystery solved: the application turns on asynchronous cancellation and
then calls malloc and all kinds of libc functions from that thread.  So
it's an application bug after all. 8-/

It just doesn't produce reliable hangs on glibc 2.40 and earlier.

Thanks,
Florian