From: Wilco Dijkstra <wilco.dijkstra@arm.com>
Date: Fri, 29 Aug 2025 12:47:54 +0000 (+0000)
Subject: malloc: Use _int_free_chunk in tcache_thread_shutdown
X-Git-Url: https://www.sourceware.org/git/?a=commitdiff_plain;h=7f670284d8b691856c2d82a260ed22b296842755;p=glibc.git

malloc: Use _int_free_chunk in tcache_thread_shutdown

Directly call _int_free_chunk during tcache shutdown to avoid recursion.
Calling __libc_free on a block from tcache gets flagged as a double free,
and tcache_double_free_verify checks every tcache chunk (quadratic
overhead).

Reviewed-by: Arjun Shankar <arjun@redhat.com>
---

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 975a005413..bd92d5c396 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3377,6 +3377,7 @@ static void
 tcache_thread_shutdown (void)
 {
   int i;
+  mchunkptr p;
   tcache_perthread_struct *tcache_tmp = tcache;
   int need_free = tcache_enabled ();
 
@@ -3396,11 +3397,14 @@ tcache_thread_shutdown (void)
 	    malloc_printerr ("tcache_thread_shutdown(): "
 			     "unaligned tcache chunk detected");
 	  tcache_tmp->entries[i] = REVEAL_PTR (e->next);
-	  __libc_free (e);
+	  e->key = 0;
+	  p = mem2chunk (e);
+	  _int_free_chunk (arena_for_chunk (p), p, chunksize (p), 0);
 	}
     }
 
-  __libc_free (tcache_tmp);
+  p = mem2chunk (tcache_tmp);
+  _int_free_chunk (arena_for_chunk (p), p, chunksize (p), 0);
 }
 
 /* Initialize tcache.  In the rare case there isn't any memory available,