Re: [PATCH] malloc: Fix missing accounting of top chunk in malloc_info [BZ #24026]

[Florian Weimer <fweimer at redhat dot com>]

* Carlos O'Donell:

> I agree with you that this looks correct, but I would
> really have expected the top chunk to be in one of
> the counted bins if it was actually free. However, it
> turns out I'm wrong. The code and logic treat top
> as a chunk which is no bin. And even when we expand
> the heap we have to manually free the old top, and only
> at that point does it enter into a bin, because the new
> top on the new heap is now the special top.
>
> Please repost with a comment to that effect added:
>
> /* The top-most available chunk is treated specially
>    and is never in any bin. See "initial_top" comments.  */

Please see below.

Thanks,
Florian

From: Niklas Hambüchen <mail@nh2.me>
Subject: malloc: Fix missing accounting of top chunk in malloc_info [BZ #24026]

Fixes `<total type="rest" size="..."> incorrectly showing as 0 most
of the time.

The rest value being wrong is significant because to compute the
actual amount of memory handed out via malloc, the user must subtract
it from <system type="current" size="...">. That result being wrong
makes investigating memory fragmentation issues like
<https://bugzilla.redhat.com/show_bug.cgi?id=843478> close to
impossible.

2019-08-07  Niklas Hambüchen  <mail@nh2.me>
	    Carlos O'Donell  <carlos@redhat.com>

	[BZ #24026]
	* malloc/malloc.c (__malloc_info): Account for top chunk.

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 343d89f489..0e65d636cd 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -5406,6 +5406,12 @@ __malloc_info (int options, FILE *fp)
 
       __libc_lock_lock (ar_ptr->mutex);
 
+      /* Account for top chunk.  The top-most available chunk is
+	 treated specially and is never in any bin. See "initial_top"
+	 comments.  */
+      avail = chunksize (ar_ptr->top);
+      nblocks = 1;  /* Top always exists.  */
+
       for (size_t i = 0; i < NFASTBINS; ++i)
 	{
 	  mchunkptr p = fastbin (ar_ptr, i);