[PATCH] malloc: Make sure tcache_key is not 0

[Samuel Thibault]

Wilco Dijkstra, le mer. 30 juil. 2025 08:57:14 +0000, a ecrit:
> > Is the issue that tcache_key == 0 is wrong from an algorithmic point of
> > view?
> 
> Zero has always been used as a value that cannot be a valid key (it would
> catastrophically bad for performance), but now it results in an endless loop.

Yes, the process simply stays stuck as soon as it calls tcache_double_free_verify

> Basically the assumption for the "key" is that it is not a commonly occurring value
> in memory. So we should exclude small positive/negative values and anything
> that doesn't appear random enough to be used (eg. check popcount is between
> 24 and 40).

So looping around __getrandom_nocancel_nostatus_direct() and
random_bits(), or only the latter?

Samuel