1
char *firstname = allocate_memory(128);
2
char *lastname = allocate_memory(256);
3

4
scanf("%s %s", firstname, lastname);
5
printf("Hello %s %s!", firstname, lastname);
6

7
free_memory(firstname);
8
free_memory(lastname);

/*
  malloc(size_t n)
  Returns a pointer to a newly allocated chunk of at least n bytes, or null
  if no space is available. Additionally, on failure, errno is
  set to ENOMEM on ANSI C systems.

  If n is zero, malloc returns a minimum-sized chunk. (The minimum
  size is 16 bytes on most 32bit systems, and 24 or 32 bytes on 64bit
  systems.)  On most systems, size_t is an unsigned type, so calls
  with negative arguments are interpreted as requests for huge amounts
  of space, which will often fail. The maximum supported value of n
  differs across systems, but is in all cases less than the maximum
  representable value of a size_t.
*/

/*
  free(void* p)
  Releases the chunk of memory pointed to by p, that had been previously
  allocated using malloc or a related routine such as realloc.
  It has no effect if p is null. It can have arbitrary (i.e., bad!)
  effects if p has already been freed.

  Unless disabled (using mallopt), freeing very large spaces will
  when possible, automatically trigger operations that give
  back unused memory to the system, thus reducing program footprint.
*/

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <fcntl.h>
4
#include <unistd.h>
5

6
#define BUF_SIZE 4096
7

8
void mem_maps() {
9
  int fd = open("/proc/self/maps", O_RDONLY);
10

11
  if (fd == -1) {
12
    perror("open failed");
13
    return;
14
  }
15

16
  char buffer[BUF_SIZE];
17
  ssize_t bytes_read;
18

19
  while ((bytes_read = read(fd, buffer, BUF_SIZE)) > 0) {
20
    write(1, buffer, bytes_read);
21
  }
22

23
  fprintf(stderr, "\n");
24

25
  if (bytes_read == -1) {
26
    perror("read failed");
27
  }
28

29
  close(fd);
30
}
31

32
int main(int argc, char *argv[])
33
{
34
  mem_maps();
35
  fprintf(stderr, "About to perform a small malloc()\n");
36
  malloc(16);
37
  mem_maps();
38
  fprintf(stderr, "About to perform a large malloc()\n");
39
  malloc(0x10000);
40
  malloc(0x10000);
41
  malloc(0x10000);
42
  mem_maps();
43
  fprintf(stderr, "About to perform a super large malloc()\n");
44
  malloc(0x100000);
45
  mem_maps();
46

47
  return 0;
48
}

openat(AT_FDCWD, '/proc/self/maps', O_RDONLY) = 3
read(3, 0x00007ffe3d394790, 4096)        = 2104 (0x0000000000000838)
5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e43000-5cce27e44000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e44000-5cce27e45000 rw-p 00003000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
71b642383000-71b642386000 rw-p 00000000 00:00 0
71b642386000-71b6423aa000 r--p 00000000 103:06 10882402                  /usr/lib/libc.so.6
71b6423aa000-71b64251b000 r-xp 00024000 103:06 10882402                  /usr/lib/libc.so.6
71b64251b000-71b64256a000 r--p 00195000 103:06 10882402                  /usr/lib/libc.so.6
71b64256a000-71b64256e000 r--p 001e3000 103:06 10882402                  /usr/lib/libc.so.6
71b64256e000-71b642570000 rw-p 001e7000 103:06 10882402                  /usr/lib/libc.so.6
71b642570000-71b64257a000 rw-p 00000000 00:00 0
71b6425a3000-71b6425a5000 r--p 00000000 00:00 0                          [vvar]
71b6425a5000-71b6425a7000 r--p 00000000 00:00 0                          [vvar_vclock]
71b6425a7000-71b6425a9000 r-xp 00000000 00:00 0                          [vdso]
71b6425a9000-71b6425aa000 r--p 00000000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425aa000-71b6425d3000 r-xp 00001000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425d3000-71b6425de000 r--p 0002a000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425de000-71b6425e0000 r--p 00035000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e0000-71b6425e1000 rw-p 00037000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e1000-71b6425e2000 rw-p 00000000 00:00 0
7ffe3d376000-7ffe3d397000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
write(1, '5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                   '..., 2104) = 2104 (0x0000000000000838)
read(3, 0x00007ffe3d394790, 4096)        = 0

write(2, '\n', 1)                        = 1
close(3)                                 = 0
About to perform a small malloc()
write(2, 'About to perform a small malloc()\n', 34) = 34 (0x0000000000000022)
getrandom(0x000071b642575238, 8, 1)      = 8
brk(0)                                   = 102041435488256 (0x00005cce5f83c000)
brk(102041435623424)                     = 102041435623424 (0x00005cce5f85d000)
openat(AT_FDCWD, '/proc/self/maps', O_RDONLY) = 3
read(3, 0x00007ffe3d394790, 4096)        = 2184 (0x0000000000000888)
5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e43000-5cce27e44000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e44000-5cce27e45000 rw-p 00003000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce5f83c000-5cce5f85d000 rw-p 00000000 00:00 0                          [heap]
71b642383000-71b642386000 rw-p 00000000 00:00 0
71b642386000-71b6423aa000 r--p 00000000 103:06 10882402                  /usr/lib/libc.so.6
71b6423aa000-71b64251b000 r-xp 00024000 103:06 10882402                  /usr/lib/libc.so.6
71b64251b000-71b64256a000 r--p 00195000 103:06 10882402                  /usr/lib/libc.so.6
71b64256a000-71b64256e000 r--p 001e3000 103:06 10882402                  /usr/lib/libc.so.6
71b64256e000-71b642570000 rw-p 001e7000 103:06 10882402                  /usr/lib/libc.so.6
71b642570000-71b64257a000 rw-p 00000000 00:00 0
71b6425a3000-71b6425a5000 r--p 00000000 00:00 0                          [vvar]
71b6425a5000-71b6425a7000 r--p 00000000 00:00 0                          [vvar_vclock]
71b6425a7000-71b6425a9000 r-xp 00000000 00:00 0                          [vdso]
71b6425a9000-71b6425aa000 r--p 00000000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425aa000-71b6425d3000 r-xp 00001000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425d3000-71b6425de000 r--p 0002a000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425de000-71b6425e0000 r--p 00035000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e0000-71b6425e1000 rw-p 00037000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e1000-71b6425e2000 rw-p 00000000 00:00 0
7ffe3d376000-7ffe3d397000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
write(1, '5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                   '..., 2184) = 2184 (0x0000000000000888)
read(3, 0x00007ffe3d394790, 4096)        = 0

write(2, '\n', 1)                        = 1
close(3)                                 = 0
About to perform a large malloc()
write(2, 'About to perform a large malloc()\n', 34) = 34 (0x0000000000000022)
brk(102041435820032)                     = 102041435820032 (0x00005cce5f88d000)
openat(AT_FDCWD, '/proc/self/maps', O_RDONLY) = 3
read(3, 0x00007ffe3d394790, 4096)        = 2184 (0x0000000000000888)
5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e43000-5cce27e44000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e44000-5cce27e45000 rw-p 00003000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce5f83c000-5cce5f88d000 rw-p 00000000 00:00 0                          [heap]
71b642383000-71b642386000 rw-p 00000000 00:00 0
71b642386000-71b6423aa000 r--p 00000000 103:06 10882402                  /usr/lib/libc.so.6
71b6423aa000-71b64251b000 r-xp 00024000 103:06 10882402                  /usr/lib/libc.so.6
71b64251b000-71b64256a000 r--p 00195000 103:06 10882402                  /usr/lib/libc.so.6
71b64256a000-71b64256e000 r--p 001e3000 103:06 10882402                  /usr/lib/libc.so.6
71b64256e000-71b642570000 rw-p 001e7000 103:06 10882402                  /usr/lib/libc.so.6
71b642570000-71b64257a000 rw-p 00000000 00:00 0
71b6425a3000-71b6425a5000 r--p 00000000 00:00 0                          [vvar]
71b6425a5000-71b6425a7000 r--p 00000000 00:00 0                          [vvar_vclock]
71b6425a7000-71b6425a9000 r-xp 00000000 00:00 0                          [vdso]
71b6425a9000-71b6425aa000 r--p 00000000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425aa000-71b6425d3000 r-xp 00001000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425d3000-71b6425de000 r--p 0002a000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425de000-71b6425e0000 r--p 00035000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e0000-71b6425e1000 rw-p 00037000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e1000-71b6425e2000 rw-p 00000000 00:00 0
7ffe3d376000-7ffe3d397000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
write(1, '5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                   '..., 2184) = 2184 (0x0000000000000888)
read(3, 0x00007ffe3d394790, 4096)        = 0

write(2, '\n', 1)                        = 1
close(3)                                 = 0
About to perform a super large malloc()
write(2, 'About to perform a super large malloc()\n', 40) = 40 (0x0000000000000028)
mmap(0, 1052672, <PROT_READ|PROT_WRITE> (3), 34, 4294967295, 0) = 125027607912448 (0x000071b642282000)
openat(AT_FDCWD, '/proc/self/maps', O_RDONLY) = 3
read(3, 0x00007ffe3d394790, 4096)        = 2184 (0x0000000000000888)
5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e43000-5cce27e44000 r--p 00002000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce27e44000-5cce27e45000 rw-p 00003000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap
5cce5f83c000-5cce5f88d000 rw-p 00000000 00:00 0                          [heap]
71b642282000-71b642386000 rw-p 00000000 00:00 0
71b642386000-71b6423aa000 r--p 00000000 103:06 10882402                  /usr/lib/libc.so.6
71b6423aa000-71b64251b000 r-xp 00024000 103:06 10882402                  /usr/lib/libc.so.6
71b64251b000-71b64256a000 r--p 00195000 103:06 10882402                  /usr/lib/libc.so.6
71b64256a000-71b64256e000 r--p 001e3000 103:06 10882402                  /usr/lib/libc.so.6
71b64256e000-71b642570000 rw-p 001e7000 103:06 10882402                  /usr/lib/libc.so.6
71b642570000-71b64257a000 rw-p 00000000 00:00 0
71b6425a3000-71b6425a5000 r--p 00000000 00:00 0                          [vvar]
71b6425a5000-71b6425a7000 r--p 00000000 00:00 0                          [vvar_vclock]
71b6425a7000-71b6425a9000 r-xp 00000000 00:00 0                          [vdso]
71b6425a9000-71b6425aa000 r--p 00000000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425aa000-71b6425d3000 r-xp 00001000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425d3000-71b6425de000 r--p 0002a000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425de000-71b6425e0000 r--p 00035000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e0000-71b6425e1000 rw-p 00037000 103:06 10882358                  /usr/lib/ld-linux-x86-64.so.2
71b6425e1000-71b6425e2000 rw-p 00000000 00:00 0
7ffe3d376000-7ffe3d397000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
write(1, '5cce27e40000-5cce27e41000 r--p 00000000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e41000-5cce27e42000 r-xp 00001000 103:07 131093                    /home/cub3y0nd/Projects/pwn.college/heap\n5cce27e42000-5cce27e43000 r--p 00002000 103:07 131093                   '..., 2184) = 2184 (0x0000000000000888)
read(3, 0x00007ffe3d394790, 4096)        = 0

write(2, '\n', 1)                        = 1
close(3)                                 = 0
exit_group(0)
*** Process 147011 exited normally ***

89 collapsed lines
/* Malloc implementation for multiple threads without lock contention.
   Copyright (C) 1996-2025 Free Software Foundation, Inc.
   Copyright The GNU Toolchain Authors.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public License as
   published by the Free Software Foundation; either version 2.1 of the
   License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; see the file COPYING.LIB.  If
   not, see <https://www.gnu.org/licenses/>.  */

/*
  This is a version (aka ptmalloc2) of malloc/free/realloc written by
  Doug Lea and adapted to multiple threads/arenas by Wolfram Gloger.

  There have been substantial changes made after the integration into
  glibc in all parts of the code.  Do not look for much commonality
  with the ptmalloc2 version.

* Version ptmalloc2-20011215
  based on:
  VERSION 2.7.0 Sun Mar 11 14:14:06 2001  Doug Lea  (dl at gee)

* Quickstart

  In order to compile this implementation, a Makefile is provided with
  the ptmalloc2 distribution, which has pre-defined targets for some
  popular systems (e.g. "make posix" for Posix threads).  All that is
  typically required with regard to compiler flags is the selection of
  the thread package via defining one out of USE_PTHREADS, USE_THR or
  USE_SPROC.  Check the thread-m.h file for what effects this has.
  Many/most systems will additionally require USE_TSD_DATA_HACK to be
  defined, so this is the default for "make posix".

* Why use this malloc?

  This is not the fastest, most space-conserving, most portable, or
  most tunable malloc ever written. However it is among the fastest
  while also being among the most space-conserving, portable and tunable.
  Consistent balance across these factors results in a good general-purpose
  allocator for malloc-intensive programs.

  The main properties of the algorithms are:
  * For large (>= 512 bytes) requests, it is a pure best-fit allocator,
    with ties normally decided via FIFO (i.e. least recently used).
  * For small (<= 64 bytes by default) requests, it is a caching
    allocator, that maintains pools of quickly recycled chunks.
  * In between, and for combinations of large and small requests, it does
    the best it can trying to meet both goals at once.
  * For very large requests (>= 128KB by default), it relies on system
    memory mapping facilities, if supported.

  For a longer but slightly out of date high-level description, see
     http://gee.cs.oswego.edu/dl/html/malloc.html

  You may already by default be using a C library containing a malloc
  that is  based on some version of this malloc (for example in
  linux). You might still want to use the one in this file in order to
  customize settings or to avoid overheads associated with library
  versions.

* Contents, described in more detail in "description of public routines" below.

  Standard (ANSI/SVID/...)  functions:
    malloc(size_t n);
    calloc(size_t n_elements, size_t element_size);
    free(void* p);
    realloc(void* p, size_t n);
    memalign(size_t alignment, size_t n);
    valloc(size_t n);
    mallinfo()
    mallopt(int parameter_number, int parameter_value)

  Additional functions:
    independent_calloc(size_t n_elements, size_t size, void* chunks[]);
    independent_comalloc(size_t n_elements, size_t sizes[], void* chunks[]);
    pvalloc(size_t n);
    malloc_trim(size_t pad);
    malloc_usable_size(void* p);
    malloc_stats();

* Vital statistics:

  Supported pointer representation:       4 or 8 bytes
  Supported size_t  representation:       4 or 8 bytes
       Note that size_t is allowed to be 4 bytes even if pointers are 8.
       You can adjust this by defining INTERNAL_SIZE_T

  Alignment:                              2 * sizeof(size_t) (default)
       (i.e., 8 byte alignment with 4byte size_t). This suffices for
       nearly all current machines and C compilers. However, you can
       define MALLOC_ALIGNMENT to be wider than this if necessary.

  Minimum overhead per allocated chunk:   4 or 8 bytes
       Each malloced chunk has a hidden word of overhead holding size
       and status information.

  Minimum allocated size: 4-byte ptrs:  16 bytes    (including 4 overhead)
     8-byte ptrs:  24/32 bytes (including, 4/8 overhead)

       When a chunk is freed, 12 (for 4byte ptrs) or 20 (for 8 byte
       ptrs but 4 byte size) or 24 (for 8/8) additional bytes are
       needed; 4 (8) for a trailing size field and 8 (16) bytes for
       free list pointers. Thus, the minimum allocatable size is
       16/24/32 bytes.

       Even a request for zero bytes (i.e., malloc(0)) returns a
       pointer to something of the minimum allocatable size.

       The maximum overhead wastage (i.e., number of extra bytes
       allocated than were requested in malloc) is less than or equal
       to the minimum size, except for requests >= mmap_threshold that
       are serviced via mmap(), where the worst case wastage is 2 *
       sizeof(size_t) bytes plus the remainder from a system page (the
       minimal mmap unit); typically 4096 or 8192 bytes.

  Maximum allocated size:  4-byte size_t: 2^32 minus about two pages
      8-byte size_t: 2^64 minus about two pages

       It is assumed that (possibly signed) size_t values suffice to
       represent chunk sizes. `Possibly signed' is due to the fact
       that `size_t' may be defined on a system as either a signed or
       an unsigned type. The ISO C standard says that it must be
       unsigned, but a few systems are known not to adhere to this.
       Additionally, even when size_t is unsigned, sbrk (which is by
       default used to obtain memory from system) accepts signed
       arguments, and may not be able to handle size_t-wide arguments
       with negative sign bit.  Generally, values that would
       appear as negative after accounting for overhead and alignment
       are supported only via mmap(), which does not have this
       limitation.

       Requests for sizes outside the allowed range will perform an optional
       failure action and then return null. (Requests may also
       also fail because a system is out of memory.)

  Thread-safety: thread-safe

  Compliance: I believe it is compliant with the 1997 Single Unix Specification
       Also SVID/XPG, ANSI C, and probably others as well.

* Synopsis of compile-time options:

    People have reported using previous versions of this malloc on all
    versions of Unix, sometimes by tweaking some of the defines
    below. It has been tested most extensively on Solaris and Linux.
    People also report using it in stand-alone embedded systems.

    The implementation is in straight, hand-tuned ANSI C.  It is not
    at all modular. (Sorry!)  It uses a lot of macros.  To be at all
    usable, this code should be compiled using an optimizing compiler
    (for example gcc -O3) that can simplify expressions and control
    paths. (FAQ: some macros import variables as arguments rather than
    declare locals because people reported that some debuggers
    otherwise get confused.)

    OPTION                     DEFAULT VALUE

    Compilation Environment options:

    HAVE_MREMAP                0

    Changing default word sizes:

    INTERNAL_SIZE_T            size_t

    Configuration and functionality options:

    USE_PUBLIC_MALLOC_WRAPPERS NOT defined
    USE_MALLOC_LOCK            NOT defined
    MALLOC_DEBUG               NOT defined
    REALLOC_ZERO_BYTES_FREES   1
    TRIM_FASTBINS              0

    Options for customizing MORECORE:

    MORECORE                   sbrk
    MORECORE_FAILURE           -1
    MORECORE_CONTIGUOUS        1
    MORECORE_CANNOT_TRIM       NOT defined
    MORECORE_CLEARS            1
    MMAP_AS_MORECORE_SIZE      (1024 * 1024)

    Tuning options that are also dynamically changeable via mallopt:

    DEFAULT_MXFAST             64 (for 32bit), 128 (for 64bit)
    DEFAULT_TRIM_THRESHOLD     128 * 1024
    DEFAULT_TOP_PAD            0
    DEFAULT_MMAP_THRESHOLD     128 * 1024
    DEFAULT_MMAP_MAX           65536

    There are several other #defined constants and macros that you
    probably don't want to touch unless you are extending or adapting malloc.  */

1
#if USE_TCACHE
2
/* We want 64 entries.  This is an arbitrary limit, which tunables can reduce.  */
3
# define TCACHE_MAX_BINS  64
4
# define MAX_TCACHE_SIZE tidx2usize (TCACHE_MAX_BINS-1)
5

6
/* Only used to pre-fill the tunables.  */
7
# define tidx2usize(idx) (((size_t) idx) * MALLOC_ALIGNMENT + MINSIZE - SIZE_SZ)
8

9
/* When "x" is from chunksize().  */
10
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
11
/* When "x" is a user-provided size.  */
12
# define usize2tidx(x) csize2tidx (request2size (x))
13

14
/* With rounding and alignment, the bins are...
15
   idx 0   bytes 0..24 (64-bit) or 0..12 (32-bit)
16
   idx 1   bytes 25..40 or 13..20
17
   idx 2   bytes 41..56 or 21..28
18
   etc.  */
19

20
/* This is another arbitrary limit, which tunables can change.  Each
21
   tcache bin will hold at most this number of chunks.  */
22
# define TCACHE_FILL_COUNT 7
23

24
/* Maximum chunks in tcache bins for tunables.  This value must fit the range
25
   of tcache->counts[] entries, else they may overflow.  */
26
# define MAX_TCACHE_COUNT UINT16_MAX
27
#endif

1
/* We overlay this structure on the user-data portion of a chunk when
2
   the chunk is stored in the per-thread cache.  */
3
typedef struct tcache_entry
4
{
5
  struct tcache_entry *next;
6
  /* This field exists to detect double frees.  */
7
  uintptr_t key;
8
} tcache_entry;
9

10
/* There is one of these for each thread, which contains the
11
   per-thread cache (hence "tcache_perthread_struct").  Keeping
12
   overall size low is mildly important.  Note that COUNTS and ENTRIES
13
   are redundant (we could have just counted the linked list each
14
   time), this is for performance reasons.  */
15
typedef struct tcache_perthread_struct
16
{
17
  uint16_t counts[TCACHE_MAX_BINS];
18
  tcache_entry *entries[TCACHE_MAX_BINS];
19
} tcache_perthread_struct;

1
static __thread bool tcache_shutting_down = false;
2
static __thread tcache_perthread_struct *tcache = NULL;
3

4
static void
5
tcache_init(void)
6
{
7
  mstate ar_ptr;
8
  void *victim = NULL;
9
  const size_t bytes = sizeof (tcache_perthread_struct);
10

11
  if (tcache_shutting_down)
12
    return;
13

14
  arena_get (ar_ptr, bytes);
15
  victim = _int_malloc (ar_ptr, bytes);
16
  if (!victim && ar_ptr != NULL)
17
    {
18
      ar_ptr = arena_get_retry (ar_ptr, bytes);
19
      victim = _int_malloc (ar_ptr, bytes);
20
    }
21

22

23
  if (ar_ptr != NULL)
24
    __libc_lock_unlock (ar_ptr->mutex);
25

26
  /* In a low memory situation, we may not be able to allocate memory
27
     - in which case, we just keep trying later.  However, we
28
     typically do this very early, so either there is sufficient
29
     memory, or there isn't enough memory to do non-trivial
30
     allocations anyway.  */
31
  if (victim)
32
    {
33
      tcache = (tcache_perthread_struct *) victim;
34
      memset (tcache, 0, sizeof (tcache_perthread_struct));
35
    }
36

37
}

1
static __thread bool tcache_shutting_down = false;
2
static __thread tcache_perthread_struct *tcache = NULL;
3

4
static void
5
tcache_thread_shutdown (void)
6
{
7
  int i;
8
  tcache_perthread_struct *tcache_tmp = tcache;
9

10
  tcache_shutting_down = true;
11

12
  if (!tcache)
13
    return;
14

15
  /* Disable the tcache and prevent it from being reinitialized.  */
16
  tcache = NULL;
17

18
  /* Free all of the entries and the tcache itself back to the arena
19
     heap for coalescing.  */
20
  for (i = 0; i < TCACHE_MAX_BINS; ++i)
21
    {
22
      while (tcache_tmp->entries[i])
23
 {
24
   tcache_entry *e = tcache_tmp->entries[i];
25
   if (__glibc_unlikely (!aligned_OK (e)))
26
     malloc_printerr ("tcache_thread_shutdown(): "
27
        "unaligned tcache chunk detected");
28
   tcache_tmp->entries[i] = REVEAL_PTR (e->next);
29
   __libc_free (e);
30
 }
31
    }
32

33
  __libc_free (tcache_tmp);
34
}

1
if (__glibc_unlikely (!aligned_OK (e)))
2
  malloc_printerr ("tcache_thread_shutdown(): "
3
        "unaligned tcache chunk detected");

1
/* Try to free chunk to the tcache, if success return true.
2
   Caller must ensure that chunk and size are valid.  */
3
static inline bool
4
tcache_free (mchunkptr p, INTERNAL_SIZE_T size)
5
{
6
  bool done = false;
7
  size_t tc_idx = csize2tidx (size);
8
  if (tcache != NULL && tc_idx < mp_.tcache_bins)
9
    {
10
      /* Check to see if it's already in the tcache.  */
11
      tcache_entry *e = (tcache_entry *) chunk2mem (p);
12

13
      /* This test succeeds on double free.  However, we don't 100%
14
  trust it (it also matches random payload data at a 1 in
15
  2^<size_t> chance), so verify it's not an unlikely
16
  coincidence before aborting.  */
17
      if (__glibc_unlikely (e->key == tcache_key))
18
 tcache_double_free_verify (e, tc_idx);
19

20
      if (tcache->counts[tc_idx] < mp_.tcache_count)
21
 {
22
   tcache_put (p, tc_idx);
23
   done = true;
24
 }
25
    }
26
  return done;
27
}

1
/* The chunk header is two SIZE_SZ elements, but this is used widely, so
2
   we define it here for clarity later.  */
3
#define CHUNK_HDR_SZ (2 * SIZE_SZ)
4

5
/* Convert a chunk address to a user mem pointer without correcting
6
   the tag.  */
7
#define chunk2mem(p) ((void*)((char*)(p) + CHUNK_HDR_SZ))

1
/* Verify if the suspicious tcache_entry is double free.
2
   It's not expected to execute very often, mark it as noinline.  */
3
static __attribute__ ((noinline)) void
4
tcache_double_free_verify (tcache_entry *e, size_t tc_idx)
5
{
6
  tcache_entry *tmp;
7
  size_t cnt = 0;
8
  LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
9
  for (tmp = tcache->entries[tc_idx];
10
       tmp;
11
       tmp = REVEAL_PTR (tmp->next), ++cnt)
12
    {
13
      if (cnt >= mp_.tcache_count)
14
 malloc_printerr ("free(): too many chunks detected in tcache");
15
      if (__glibc_unlikely (!aligned_OK (tmp)))
16
 malloc_printerr ("free(): unaligned chunk detected in tcache 2");
17
      if (tmp == e)
18
 malloc_printerr ("free(): double free detected in tcache 2");
19
      /* If we get here, it was a coincidence.  We've wasted a
20
  few cycles, but don't abort.  */
21
    }
22
}

1
/* Process-wide key to try and catch a double-free in the same thread.  */
2
static uintptr_t tcache_key;
3

4
/* The value of tcache_key does not really have to be a cryptographically
5
   secure random number.  It only needs to be arbitrary enough so that it does
6
   not collide with values present in applications.  If a collision does happen
7
   consistently enough, it could cause a degradation in performance since the
8
   entire list is checked to check if the block indeed has been freed the
9
   second time.  The odds of this happening are exceedingly low though, about 1
10
   in 2^wordsize.  There is probably a higher chance of the performance
11
   degradation being due to a double free where the first free happened in a
12
   different thread; that's a case this check does not cover.  */
13
static void
14
tcache_key_initialize (void)
15
{
16
  /* We need to use the _nostatus version here, see BZ 29624.  */
17
  if (__getrandom_nocancel_nostatus_direct (&tcache_key, sizeof(tcache_key),
18
         GRND_NONBLOCK)
19
      != sizeof (tcache_key))
20
    {
21
      tcache_key = random_bits ();
22
#if __WORDSIZE == 64
23
      tcache_key = (tcache_key << 32) | random_bits ();
24
#endif
25
    }
26
}

1
/* Caller must ensure that we know tc_idx is valid and there's room
2
   for more chunks.  */
3
static __always_inline void
4
tcache_put (mchunkptr chunk, size_t tc_idx)
5
{
6
  tcache_entry *e = (tcache_entry *) chunk2mem (chunk);
7

8
  /* Mark this chunk as "in the tcache" so the test in _int_free will
9
     detect a double free.  */
10
  e->key = tcache_key;
11

12
  e->next = PROTECT_PTR (&e->next, tcache->entries[tc_idx]);
13
  tcache->entries[tc_idx] = e;
14
  ++(tcache->counts[tc_idx]);
15
}

1
/* Safe-Linking:
2
   Use randomness from ASLR (mmap_base) to protect single-linked lists
3
   of Fast-Bins and TCache.  That is, mask the "next" pointers of the
4
   lists' chunks, and also perform allocation alignment checks on them.
5
   This mechanism reduces the risk of pointer hijacking, as was done with
6
   Safe-Unlinking in the double-linked lists of Small-Bins.
7
   It assumes a minimum page size of 4096 bytes (12 bits).  Systems with
8
   larger pages provide less entropy, although the pointer mangling
9
   still works.  */
10
#define PROTECT_PTR(pos, ptr) \
11
  ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr)))
12
#define REVEAL_PTR(ptr)  PROTECT_PTR (&ptr, ptr)