malloc: Reject the top chunk in mem2chunk_check

[Wilco Dijkstra]

Hi Magnus,

> mem2chunk_check uses inuse to validate a candidate chunk. However,
> inuse obtains the chunk state from the header of the following chunk
> and therefore must not be called for the top chunk, which has no
> following chunk.
>
> The existing main-arena boundary check implicitly rejects the top
> chunk when the arena is contiguous. When the main arena is marked
> noncontiguous, that boundary check is skipped and mem2chunk_check can
> instead call inuse on the top chunk.
>
> This was exposed by the malloc-check tests on Alpha, where the main
> arena used the noncontiguous 1 MiB mmap fallback. An invalid pointer
> was interpreted as the top chunk, and inuse read beyond the end of the
> mapping, causing a segmentation fault instead of diagnosing the
> invalid pointer.
>
> Explicitly reject the top chunk before calling inuse. The top chunk
> is unallocated space and cannot be a valid result of mem2chunk_check.
>
> This fixes tst-tcfree1-malloc-check and tst-tcfree2-malloc-check on
> Alpha.
>
> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>

LGTM.

Reviewed-by: Wilco Dijkstra  <Wilco.Dijkstra@arm.com>

Cheers,
Wilco