2.23堆相关源码阅读笔记

做hgame-week2的堆题时发现自己对于堆的malloc和free相关机制还没有建立一个整体的结构印象，所以决定从源码阅读开始建构关于堆的知识体系。
这是我假期堆学习计划的开始，也是博客建立后的第一篇文章，纪念一下。(ง •_•)ง

相关结构体

malloc_chunk

malloc_chunk结构体源码（size只有M和P标志位）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
//低地址
struct malloc_chunk {

  INTERNAL_SIZE_T      prev_size;  /* Size of previous chunk (if free).  */
  INTERNAL_SIZE_T      size;       /* Size in bytes, including overhead. */

  struct malloc_chunk* fd;         /* double links -- used only if free. */
  struct malloc_chunk* bk;

  /* Only used for large blocks: pointer to next larger size.  */
  struct malloc_chunk* fd_nextsize; /* double links -- used only if free. */
  struct malloc_chunk* bk_nextsize;
};
//高地址

相关注释注意事项：

  • chunk的size成员、下一个chunk的pre_size成员以及它们的P位决定了free chunk的合并，这一点在后续相关函数的源码中也有体现
  • 堆指针实际指向chunk的size成员，返回给用户的指针则指向chunk的data部分，即fd成员
  • 堆地址对其0x10（本文所有保证兼容性的操作都以64位系统为例），具体对齐方式见后续相关函数
  • top chunk从低地址开始切分
  • 如果剩余堆空间不够分配，则启用mmap()进行分配，同时将分配出来的chunk的M位置1

malloc_state

malloc_state结构体源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
struct malloc_state
{
  /* Serialize access.  */
  mutex_t mutex;

  /* Flags (formerly in max_fast).  */
  int flags;

  /* Fastbins */
  mfastbinptr fastbinsY[NFASTBINS];

  /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr top;

  /* The remainder from the most recent split of a small request */
  mchunkptr last_remainder;

  /* Normal bins packed as described above */
  mchunkptr bins[NBINS * 2 - 2];

  /* Bitmap of bins */
  unsigned int binmap[BINMAPSIZE];

  /* Linked list */
  struct malloc_state *next;

  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;

  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;

  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

/* There are several instances of this struct ("arenas") in this
   malloc.  If you are adapting this malloc in a way that does NOT use
   a static or mmapped malloc_state, you MUST explicitly zero-fill it
   before using. This malloc relies on the property that malloc_state
   is initialized to all zeroes (as is true of C statics).  */

static struct malloc_state main_arena =
{
  .mutex = _LIBC_LOCK_INITIALIZER,
  .next = &main_arena,
  .attached_threads = 1
};

注意事项：

  • 主线程的malloc_state即main_arena保存在libc.so的数据段中
  • 运行时malloc_arena在malloc_hook上方不远处，因此可以用malloc_hook定位main_arena

相关宏定义

大小、对齐检查及转化

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#define chunk2mem(p)   ((void*)((char*)(p) + 2*SIZE_SZ))
#define mem2chunk(mem) ((mchunkptr)((char*)(mem) - 2*SIZE_SZ))
//堆地址和用户地址相隔一个size成员和一个pre_size成员

/* Check if m has acceptable alignment */

#define aligned_OK(m)  (((unsigned long)(m) & MALLOC_ALIGN_MASK) == 0)

#define misaligned_chunk(p) \
  ((uintptr_t)(MALLOC_ALIGNMENT == 2 * SIZE_SZ ? (p) : chunk2mem (p)) \
   & MALLOC_ALIGN_MASK)
//0x10对齐检查，MALLOC_ALIGNMENT是malloc的最小对齐参数(0x10)，MALLOC_ALIGN_MASK（0xf）

#ifndef MALLOC_ALIGNMENT
# if !SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_16)
#  define MALLOC_ALIGNMENT       (2 *SIZE_SZ < __alignof__ (long double)      \
                                  ? __alignof__ (long double) : 2 *SIZE_SZ)
# else
#  define MALLOC_ALIGNMENT       (2 *SIZE_SZ)
# endif
#endif

/* The corresponding bit mask value */
#define MALLOC_ALIGN_MASK      (MALLOC_ALIGNMENT - 1)

#define request2size(req)                                         \
  (((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE)  ?             \
   MINSIZE :                                                      \
   ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)

#define checked_request2size(req, sz)                             \
  if (REQUEST_OUT_OF_RANGE (req)) {					      \
      __set_errno (ENOMEM);						      \
      return 0;								      \
    }									      \
  (sz) = request2size (req);

重点解释一下request2size(req)

  • 当req<MINSIZE-MALLOC_ALIGN_MASK-SIZE_SZ(0x9)时，返回0x20（满足pre_size+size+fd+bk所需大小）
  • req=n(0x10)+0x8时（n>0），返回(n+1)(0x10)，chunk本身的data部分n(0x10)，nextchunk的pre_size0x10也用作data
  • req=n(0x10)时（n>0），返回(n+1)(0x10)，data为n(0x10)
  • checked_request2size比request2size多一步检查数据范围，更安全

chunk相关掩码操作

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
/* size field is or'ed with PREV_INUSE when previous adjacent chunk in use */
#define PREV_INUSE 0x1

/* extract inuse bit of previous chunk */
#define prev_inuse(p)       ((p)->size & PREV_INUSE)


/* size field is or'ed with IS_MMAPPED if the chunk was obtained with mmap() */
#define IS_MMAPPED 0x2

/* check for mmap()'ed chunk */
#define chunk_is_mmapped(p) ((p)->size & IS_MMAPPED)


/* size field is or'ed with NON_MAIN_ARENA if the chunk was obtained
   from a non-main arena.  This is only set immediately before handing
   the chunk to the user, if necessary.  */
#define NON_MAIN_ARENA 0x4

/* check for chunk from non-main arena */
#define chunk_non_main_arena(p) ((p)->size & NON_MAIN_ARENA)


/*
   Bits to mask off when extracting size

   Note: IS_MMAPPED is intentionally not masked off from size field in
   macros for which mmapped chunks should never be seen. This should
   cause helpful core dumps to occur if it is tried by accident by
   people extending or adapting this malloc.
 */
#define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)

/* Get size, ignoring use bits */
#define chunksize(p)         ((p)->size & ~(SIZE_BITS))


/* Ptr to next physical malloc_chunk. */
#define next_chunk(p) ((mchunkptr) (((char *) (p)) + ((p)->size & ~SIZE_BITS)))

/* Ptr to previous physical malloc_chunk */
#define prev_chunk(p) ((mchunkptr) (((char *) (p)) - ((p)->prev_size)))

/* Treat space at ptr + offset as a chunk */
#define chunk_at_offset(p, s)  ((mchunkptr) (((char *) (p)) + (s)))

/* extract p's inuse bit */
#define inuse(p)							      \
  ((((mchunkptr) (((char *) (p)) + ((p)->size & ~SIZE_BITS)))->size) & PREV_INUSE)

/* set/clear chunk as being inuse without otherwise disturbing */
#define set_inuse(p)							      \
  ((mchunkptr) (((char *) (p)) + ((p)->size & ~SIZE_BITS)))->size |= PREV_INUSE
//chunk的使用状态是由nextchunk的pre_inuse位判断的

#define clear_inuse(p)							      \
  ((mchunkptr) (((char *) (p)) + ((p)->size & ~SIZE_BITS)))->size &= ~(PREV_INUSE)


/* check/set/clear inuse bits in known places */
#define inuse_bit_at_offset(p, s)					      \
  (((mchunkptr) (((char *) (p)) + (s)))->size & PREV_INUSE)

#define set_inuse_bit_at_offset(p, s)					      \
  (((mchunkptr) (((char *) (p)) + (s)))->size |= PREV_INUSE)

#define clear_inuse_bit_at_offset(p, s)					      \
  (((mchunkptr) (((char *) (p)) + (s)))->size &= ~(PREV_INUSE))


/* Set size at head, without disturbing its use bit */
#define set_head_size(p, s)  ((p)->size = (((p)->size & SIZE_BITS) | (s)))

/* Set size/use field */
#define set_head(p, s)       ((p)->size = (s))

/* Set size at footer (only when chunk is not in use) */
#define set_foot(p, s)       (((mchunkptr) ((char *) (p) + (s)))->prev_size = (s))

注意：

  • chunk大部分操作都可以“顾名思义”
  • 以上源码可以体现chunk的寻址是由pre_size和size决定的

bins相关源码

bins通用宏定义

bins部分总注释略，大意：

  • bins中共有128个bin链，bin链为双链表
  • bin链按所含chunk的范围大小排布
  • 一条bin链中的chunk遵循FIFO原则
  • ！bins数组元素被看作chunk的bk和fd，这个思维在源码理解时非常重要
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    typedef struct malloc_chunk *mbinptr;

    /* addressing -- note that bin_at(0) does not exist */
    #define bin_at(m, i) \
      (mbinptr) (((char *) &((m)->bins[((i) - 1) * 2]))			      \
                 - offsetof (struct malloc_chunk, fd))
    //定义中不存在bin 0，bin 1为unsorted bin（所以-1），一个bin占用bins的两个元素（所以*2）
    //bins数组元素被看作chunk的fd和bk（所以减去fd成员在结构体malloc_chunk中的偏移）

    /* analog of ++bin */
    #define next_bin(b)  ((mbinptr) ((char *) (b) + (sizeof (mchunkptr) << 1)))

    /* Reminders about list directionality within bins */
    #define first(b)     ((b)->fd)
    #define last(b)      ((b)->bk)
    //bin链中的第一个chunk由bin的fd决定，最后一个chunk由bk决定

    /* Take a chunk off a bin list */
    #define unlink(AV, P, BK, FD) {                                            \
        FD = P->fd;								      \
        BK = P->bk;								      \
        if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      \
          malloc_printerr (check_action, "corrupted double-linked list", P, AV);  \
        else {								      \
            FD->bk = BK;							      \
            BK->fd = FD;							      \
            if (!in_smallbin_range (P->size)				      \
                && __builtin_expect (P->fd_nextsize != NULL, 0)) {		      \
    	    if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)	      \
    		|| __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    \
    	      malloc_printerr (check_action,				      \
    			       "corrupted double-linked list (not small)",    \
    			       P, AV);					      \
                if (FD->fd_nextsize == NULL) {				      \
                    if (P->fd_nextsize == P)				      \
                      FD->fd_nextsize = FD->bk_nextsize = FD;		      \
                    else {							      \
                        FD->fd_nextsize = P->fd_nextsize;			      \
                        FD->bk_nextsize = P->bk_nextsize;			      \
                        P->fd_nextsize->bk_nextsize = FD;			      \
                        P->bk_nextsize->fd_nextsize = FD;			      \
                      }							      \
                  } else {							      \
                    P->fd_nextsize->bk_nextsize = P->bk_nextsize;		      \
                    P->bk_nextsize->fd_nextsize = P->fd_nextsize;		      \
                  }								      \
              }								      \
          }									      \
    }
    //从bin链中摘除chunk P，相关解释见unsafe_unlink
chunk在bins中定址相关宏定义
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
#define NBINS             128
#define NSMALLBINS         64
#define SMALLBIN_WIDTH    MALLOC_ALIGNMENT
#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > 2 * SIZE_SZ)
#define MIN_LARGE_SIZE    ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH)

#define in_smallbin_range(sz)  \
  ((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE)
//sz<0x3f0

#define smallbin_index(sz) \
  ((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\
   + SMALLBIN_CORRECTION)
//很多保证兼容性的操作
//small bin从2到63共62个
//64位：每个small bin的大小都是2*SIZE_SZ*idx（bins数组下标）

#define largebin_index(sz) \
  (SIZE_SZ == 8 ? largebin_index_64 (sz)                                     \
   : MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz)                     \
   : largebin_index_32 (sz))
//还是保证兼容性的操作，SIZE_SZ==8（64位）执行largebin_index_64版本的寻址宏

#define largebin_index_64(sz)                                                \
  (((((unsigned long) (sz)) >> 6) <= 48) ?  48 + (((unsigned long) (sz)) >> 6) :\
   ((((unsigned long) (sz)) >> 9) <= 20) ?  91 + (((unsigned long) (sz)) >> 9) :\
   ((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
   ((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
   ((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
   126)
/*
    数量            bin中chunk之间的公差
    64 bins of size       8 small bin
    32 bins of size      64
    16 bins of size     512
     8 bins of size    4096
     4 bins of size   32768
     2 bins of size  262144 large bin
     1 bin  of size what's left

第1个large bin链中的chunk大小为[1024,1024+64)
第2个large bin链中的chunk大小为[1024+64,1024+128)
……
第33个large bin链中的chunk大小为[xxxx,xxxx+512)
以此类推
 */

#define bin_index(sz) \
  ((in_smallbin_range (sz)) ? smallbin_index (sz) : largebin_index (sz))
unsorted bin、top chunk和binmap
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
//unsorted chunks
#define unsorted_chunks(M)          (bin_at (M, 1))

//top
#define initial_top(M)              (unsorted_chunks (M))

//binmap
#define BINMAPSHIFT      5
//128个bin，一个bin用1bit表示，每个binmap元素存32bit
#define BITSPERMAP       (1U << BINMAPSHIFT)
//32，<<的参数是右边那个(ˉ▽ˉ；)...
#define BINMAPSIZE       (NBINS / BITSPERMAP)
//binmap数组大小

#define idx2block(i)     ((i) >> BINMAPSHIFT)
#define idx2bit(i)       ((1U << ((i) & ((1U << BINMAPSHIFT) - 1))))

#define mark_bin(m, i)    ((m)->binmap[idx2block (i)] |= idx2bit (i))
#define unmark_bin(m, i)  ((m)->binmap[idx2block (i)] &= ~(idx2bit (i)))
#define get_binmap(m, i)  ((m)->binmap[idx2block (i)] & idx2bit (i))
fastbin相关宏定义
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
typedef struct malloc_chunk *mfastbinptr;
#define fastbin(ar_ptr, idx) ((ar_ptr)->fastbinsY[idx])

/* offset 2 to use otherwise unindexable first 2 bins */
#define fastbin_index(sz) \
  ((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)

/* The maximum fastbin request size we support */
#define MAX_FAST_SIZE     (80 * SIZE_SZ / 4)

#define NFASTBINS  (fastbin_index (request2size (MAX_FAST_SIZE)) + 1)

#define FASTBIN_CONSOLIDATION_THRESHOLD  (65536UL)
//当合并chunk>FASTBIN_CONSOLIDATION_THRESHOLD时
//触发malloc_consolidate()函数合并fastbin中的chunk

#define set_max_fast(s) \
  global_max_fast = (((s) == 0)						      \
                     ? SMALLBIN_WIDTH : ((s + SIZE_SZ) & ~MALLOC_ALIGN_MASK))
#define get_max_fast() global_max_fast

相关函数

malloc

__libc_malloc源码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
void *
__libc_malloc (size_t bytes)
{
  mstate ar_ptr;
  void *victim;

  void *(*hook) (size_t, const void *)
    = atomic_forced_read (__malloc_hook);
  if (__builtin_expect (hook != NULL, 0))
    return (*hook)(bytes, RETURN_ADDRESS (0));
//读取__malloc_hook钩子函数，如果有则运行钩子函数并返回

  arena_get (ar_ptr, bytes);
//寻找一个arena分配内存

  victim = _int_malloc (ar_ptr, bytes);
//调用_int_malloc()分配内存
  /* Retry with another arena only if we were able to find a usable arena
     before.  */
//不成功就继续尝试寻找arena
  if (!victim && ar_ptr != NULL)
    {
      LIBC_PROBE (memory_malloc_retry, 1, bytes);
      ar_ptr = arena_get_retry (ar_ptr, bytes);
      victim = _int_malloc (ar_ptr, bytes);
    }
//申请anera还需要解锁
  if (ar_ptr != NULL)
    (void) mutex_unlock (&ar_ptr->mutex);

  assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||
          ar_ptr == arena_for_chunk (mem2chunk (victim)));
//检查  
	return victim;
}
_int_malloc源码及解析

_int_malloc中堆块的搜索顺序：

  1. fastbin中寻找完全一样的
  2. small bin中寻找完全一样的
  3. 如果2不满足且victim==null，调用malloc_consolidate并初始化堆
  4. 计算large bin的index，调用consolidate整理fastbin
  5. 遍历unsorted bin并整理，寻找完全一样的，如果请求的chunk属于small bin、是remainder、可拆分且是unsorted bin中唯一的chunk，拆分并返回。在遍历过程中如果遇到大小完全一样的直接返回
  6. 在large bin中找，比需求大的最小的一个，如果可分割就分割后返回，remainder插入unsorted bin，否则直接返回
  7. binmap搜索bins
  8. 切割top chunk
大小转化和arena检查

（1）请求的bytes转化为chunk的大小nb，如果没有arena就调用sysmalloc()，用mmap()分配chunk返回

1
2
3
4
5
6
7
8
    mmap.  */
 if (__glibc_unlikely (av == NULL))
   {
     void *p = sysmalloc (nb, av);
     if (p != NULL)
alloc_perturb (p, bytes);
     return p;
   }
fastbin扫描

（2）在fastbin中寻找大小完全一样的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ()))
   {
//根据nb找到fastbin相应的元素
     idx = fastbin_index (nb);
     mfastbinptr *fb = &fastbin (av, idx);
     mchunkptr pp = *fb;
//如果fastbin中有chunk按LIFO规则取出
     do
       {
         victim = pp;
         if (victim == NULL)
           break;
       }
     while ((pp = catomic_compare_and_exchange_val_acq (fb, victim->fd, victim))
            != victim);
//如果victim！=null，检查后返回给用户
     if (victim != 0)
       {
         if (__builtin_expect (fastbin_index (chunksize (victim)) != idx, 0))
           {
//chunksize和相应fastbin链的大小相符检测
             errstr = "malloc(): memory corruption (fast)";
           errout:
             malloc_printerr (check_action, errstr, chunk2mem (victim), av);
             return NULL;
           }
         check_remalloced_chunk (av, victim, nb);
         void *p = chunk2mem (victim);
         alloc_perturb (p, bytes);
         return p;
       }
   }
small bin扫描

（3）在small bin中找大小完全一样的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
if (in_smallbin_range (nb))
   {
//根据nb找small bins中相应的bin
     idx = smallbin_index (nb);
     bin = bin_at (av, idx);

     if ((victim = last (bin)) != bin)
//如果bin链不为空
//取bin链中的最后一个chunk
       {
         if (victim == 0) /* initialization check */
           malloc_consolidate (av);
//如果victim==null调用malloc_consolidate并初始化堆
         else//有符合要求的chunk
           {
             bck = victim->bk;
//检查victim->bk的fd是否指向victim
if (__glibc_unlikely (bck->fd != victim))
               {
                 errstr = "malloc(): smallbin double linked list corrupted";
                 goto errout;
               }
//victim的nextchunk的inuse位置1
             set_inuse_bit_at_offset (victim, nb);
             bin->bk = bck;
             bck->fd = bin;
//从bin链中摘下victim
             if (av != &main_arena)
               victim->size |= NON_MAIN_ARENA;
//返回给用户
             check_malloced_chunk (av, victim, nb);
             void *p = chunk2mem (victim);
             alloc_perturb (p, bytes);
             return p;
           }
       }
   }
largebin的index计算并整理fastbin

（4）如果nb不属于small bin，计算large bin的index并调用malloc_consolidate整理fastbin

1
2
3
4
5
6
else
   {
     idx = largebin_index (nb);
     if (have_fastchunks (av))
       malloc_consolidate (av);
   }
遍历unsorted bin并整理

（5）进入一个大的for(;;)循环，循环以下所有步骤。第一步先从最后一个chunk开始遍历unsorted bin并整理

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
for(;;)
{
	int iters = 0;
      while ((victim = unsorted_chunks (av)->bk) != unsorted_chunks (av))
        {
          bck = victim->bk;
	//检查chunk的大小是否符合unsorted bin
          if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0)
              || __builtin_expect (victim->size > av->system_mem, 0))
            malloc_printerr (check_action, "malloc(): memory corruption",
                             chunk2mem (victim), av);
          size = chunksize (victim);

				……


	//从unsorted bin中摘下最后一个遍历过的chunk
          unsorted_chunks (av)->bk = bck;
          bck->fd = unsorted_chunks (av);


				……



#define MAX_ITERS       10000
          if (++iters >= MAX_ITERS)
            break;
		}

	……
}
unsorted bin中先遇last_remainder

（6）如果nb属于small bin（可能上次small bin中查询时是空的）、unsorted bin只有这一个chunk、victim是last_remainder（上次切分chunk剩下的）且可以拆分的话拆分这个chunk并返回

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
	if (in_smallbin_range (nb) &&
            bck == unsorted_chunks (av) &&
            victim == av->last_remainder &&
            (unsigned long) (size) > (unsigned long) (nb + MINSIZE))
          {
            /* split and reattach remainder */
//更新remainder chunk信息
            remainder_size = size - nb;
            remainder = chunk_at_offset (victim, nb);
//新remainder连入unsorted bin
            unsorted_chunks (av)->bk = unsorted_chunks (av)->fd = remainder;
            av->last_remainder = remainder;
            remainder->bk = remainder->fd = unsorted_chunks (av);
//如果remainder处于large bin则清空fd_nextsize和bk_nextsize
            if (!in_smallbin_range (remainder_size))
              {
                remainder->fd_nextsize = NULL;
                remainder->bk_nextsize = NULL;
              }
//还是更新remainder chunk信息
            set_head (victim, nb | PREV_INUSE |
                      (av != &main_arena ? NON_MAIN_ARENA : 0));
            set_head (remainder, remainder_size | PREV_INUSE);
            set_foot (remainder, remainder_size);

//返回给用户
            check_malloced_chunk (av, victim, nb);
            void *p = chunk2mem (victim);
            alloc_perturb (p, bytes);
            return p;
          }
unsorted bin中后找到合适chunk

（7）如果大小和nb一样直接返回

1
2
3
4
5
6
7
8
9
10
if (size == nb)
  {
    set_inuse_bit_at_offset (victim, size);
    if (av != &main_arena)
      victim->size |= NON_MAIN_ARENA;
    check_malloced_chunk (av, victim, nb);
    void *p = chunk2mem (victim);
    alloc_perturb (p, bytes);
    return p;
  }
整理在遍历unsorted bin中摘下来的chunk

（8）整理分类摘下来的victim
large bin说明：

  • large bin可以看作由fd_nextsize和bk_nextsize连起来的一个个小链表，小链表用fd和bk连接，一个小链表内的chunk大小相同
  • 把large bin数组的元素当作第一个小链表，只有一个chunk，其fd和bk视为fd_nextsize和bk_nextsize，连接链表中最大的chunk链表和最小的chunk链表
  • 小链表按从大到小排列，bin元素的fd指向最大的chunk链表，bk指向最小的chunk链表
  • bin链表的最大chunk链和最小chunk链通过nextsize相连
  • 小chunk链的前后端连向两边的两个chunk链头 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    //bck表示victim的前一个chunk，fwd表示victim的后一个chunk
    //如果符合small bin
             if (in_smallbin_range (size))
               {
                 victim_index = smallbin_index (size);
                 bck = bin_at (av, victim_index);
                 fwd = bck->fd;
               }
    //否则放进large bin
             else
               {
                 victim_index = largebin_index (size);
                 bck = bin_at (av, victim_index);//第一个小链表
                 fwd = bck->fd;//第二个小链表

                 /* maintain large bins in sorted order */
                 if (fwd != bck)//链表不空
                   {
                     /* Or with inuse bit to speed comparisons */
                     size |= PREV_INUSE;
                     /* if smaller than smallest, bypass loop below */
                     assert ((bck->bk->size & NON_MAIN_ARENA) == 0);
                     if ((unsigned long) (size) < (unsigned long) (bck->bk->size))//比最小的还小
                       {
                         fwd = bck;//第一个小链表
                         bck = bck->bk;//最后一个小链表

                         victim->fd_nextsize = fwd->fd;//连接最大chunk链                    
    			victim->bk_nextsize = fwd->fd->bk_nextsize;//连接原最小chunk链
                         fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;
    		//前后相连
                       }
                     else
                       {
                         assert ((fwd->size & NON_MAIN_ARENA) == 0);
                         while ((unsigned long) size < fwd->size)
                           {
                             fwd = fwd->fd_nextsize;
                             assert ((fwd->size & NON_MAIN_ARENA) == 0);
                           }//找到第一个比victim小的

                         if ((unsigned long) size == (unsigned long) fwd->size)
                           /* Always insert in the second position.  */
                           fwd = fwd->fd;
                         else
                           {
                             victim->fd_nextsize = fwd;
                             victim->bk_nextsize = fwd->bk_nextsize;
                             fwd->bk_nextsize = victim;
                             victim->bk_nextsize->fd_nextsize = victim;
    			//接入nextsize链
                           }
                         bck = fwd->bk;
                       }
                   }
                 else//如果链空
                   victim->fd_nextsize = victim->bk_nextsize = victim;
               }
    //接入bin链
             mark_bin (av, victim_index);//标识binmap
             victim->bk = bck;
             victim->fd = fwd;
             fwd->bk = victim;
             bck->fd = victim;
在large bin中查找

（9）在large bin中找

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
//如果nb在large bin范围内
     if (!in_smallbin_range (nb))
       {
         bin = bin_at (av, idx);

         /* skip scan if empty or largest chunk is too small */
//如果bin中非空且最大chunk的size>nb，
         if ((victim = first (bin)) != bin &&
             (unsigned long) (victim->size) >= (unsigned long) (nb))
           {
             victim = victim->bk_nextsize;
//定位至最小的chunk链
             while (((unsigned long) (size = chunksize (victim)) <
                     (unsigned long) (nb)))
               victim = victim->bk_nextsize;

             /* Avoid removing the first entry for a size so that the skip
                list does not have to be rerouted.  */
             if (victim != last (bin) && victim->size == victim->fd->size)
               victim = victim->fd;
//避免移走有很多个chunk的小chunk链的头结点

             remainder_size = size - nb;
             unlink (av, victim, bck, fwd);
//摘除

             /* Exhaust */
//不能切分则全部返回
             if (remainder_size < MINSIZE)
               {
                 set_inuse_bit_at_offset (victim, size);
                 if (av != &main_arena)
                   victim->size |= NON_MAIN_ARENA;
               }
             /* Split */
             else
//能切分则切分后返回，并将remainder插入unsorted bin
               {
                 remainder = chunk_at_offset (victim, nb);
                 /* We cannot assume the unsorted list is empty and therefore
                    have to perform a complete insert here.  */
                 bck = unsorted_chunks (av);
                 fwd = bck->fd;
  if (__glibc_unlikely (fwd->bk != bck))
                   {
                     errstr = "malloc(): corrupted unsorted chunks";
                     goto errout;
                   }
                 remainder->bk = bck;
                 remainder->fd = fwd;
                 bck->fd = remainder;
                 fwd->bk = remainder;
//如果remainder大小属于fast bin则nextsize指针置零
                 if (!in_smallbin_range (remainder_size))
                   {
                     remainder->fd_nextsize = NULL;
                     remainder->bk_nextsize = NULL;
                   }
                 set_head (victim, nb | PREV_INUSE |
                           (av != &main_arena ? NON_MAIN_ARENA : 0));
                 set_head (remainder, remainder_size | PREV_INUSE);
                 set_foot (remainder, remainder_size);
               }
             check_malloced_chunk (av, victim, nb);
             void *p = chunk2mem (victim);
             alloc_perturb (p, bytes);
             return p;
           }
       }
binmap搜索bin

（10）进入内层第二个for(;;)循环，根据binmap搜索bins

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
//定位binmap数组
      ++idx;
      bin = bin_at (av, idx);
      block = idx2block (idx);
      map = av->binmap[block];
      bit = idx2bit (idx);

      for (;; )
        {
          /* Skip rest of block if there are no more set bits in this block.  */
          if (bit > map || bit == 0)
            {
              do//找比要求大小大的第一个bin_block
                {
                  if (++block >= BINMAPSIZE) /* out of bins */
                    goto use_top;//如果bins全空，切割top chunk
                }
              while ((map = av->binmap[block]) == 0);

              bin = bin_at (av, (block << BINMAPSHIFT));
              bit = 1;
            }

          /* Advance to bin with set bit. There must be one. */
          while ((bit & map) == 0)//定位bin
            {
              bin = next_bin (bin);
              bit <<= 1;
              assert (bit != 0);
            }

          /* Inspect the bin. It is likely to be non-empty */
          victim = last (bin);

          /*  If a false alarm (empty bin), clear the bit. */
          if (victim == bin)
            {
              av->binmap[block] = map &= ~bit; /* Write through */
              bin = next_bin (bin);
              bit <<= 1;
            }

          else//切割并将remainder插入unsorted bin，同上
            {
              size = chunksize (victim);

              /*  We know the first chunk in this bin is big enough to use. */
              assert ((unsigned long) (size) >= (unsigned long) (nb));

              remainder_size = size - nb;

              /* unlink */
              unlink (av, victim, bck, fwd);

              /* Exhaust */
              if (remainder_size < MINSIZE)
                {
                  set_inuse_bit_at_offset (victim, size);
                  if (av != &main_arena)
                    victim->size |= NON_MAIN_ARENA;
                }

              /* Split */
              else
                {
                  remainder = chunk_at_offset (victim, nb);

                  /* We cannot assume the unsorted list is empty and therefore
                     have to perform a complete insert here.  */
                  bck = unsorted_chunks (av);
                  fwd = bck->fd;
	  if (__glibc_unlikely (fwd->bk != bck))
                    {
                      errstr = "malloc(): corrupted unsorted chunks 2";
                      goto errout;
                    }
                  remainder->bk = bck;
                  remainder->fd = fwd;
                  bck->fd = remainder;
                  fwd->bk = remainder;

                  /* advertise as last remainder */
                  if (in_smallbin_range (nb))
                    av->last_remainder = remainder;
                  if (!in_smallbin_range (remainder_size))
                    {
                      remainder->fd_nextsize = NULL;
                      remainder->bk_nextsize = NULL;
                    }
                  set_head (victim, nb | PREV_INUSE |
                            (av != &main_arena ? NON_MAIN_ARENA : 0));
                  set_head (remainder, remainder_size | PREV_INUSE);
                  set_foot (remainder, remainder_size);
                }
              check_malloced_chunk (av, victim, nb);
              void *p = chunk2mem (victim);
              alloc_perturb (p, bytes);
              return p;
            }
        }
切割top chunk

（11）切割top chunk

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
   use_top:

     victim = av->top;
     size = chunksize (victim);

//top chunk可切割就切割并返回
     if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
       {
         remainder_size = size - nb;
         remainder = chunk_at_offset (victim, nb);
         av->top = remainder;
         set_head (victim, nb | PREV_INUSE |
                   (av != &main_arena ? NON_MAIN_ARENA : 0));
         set_head (remainder, remainder_size | PREV_INUSE);

         check_malloced_chunk (av, victim, nb);
         void *p = chunk2mem (victim);
         alloc_perturb (p, bytes);
         return p;
       }

     /* When we are using atomic ops to free fast chunks we can get
        here for all block sizes.  */
     else if (have_fastchunks (av))
       {
         malloc_consolidate (av);//如果fastbin非空，整理
         /* restore original bin index */
         if (in_smallbin_range (nb))//确定index，外部循环再次尝试
           idx = smallbin_index (nb);
         else
           idx = largebin_index (nb);
       }

     /*
        Otherwise, relay to handle system-dependent cases
      */
     else//否则sysmalloc分配
       {
         void *p = sysmalloc (nb, av);
         if (p != NULL)
           alloc_perturb (p, bytes);
         return p;
       }

free

__libc_free
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
void
__libc_free (void *mem)
{
  mstate ar_ptr;
  mchunkptr p;                          /* chunk corresponding to mem */

  void (*hook) (void *, const void *)
    = atomic_forced_read (__free_hook);
  if (__builtin_expect (hook != NULL, 0))
    {
      (*hook)(mem, RETURN_ADDRESS (0));
      return;
    }
//读取free_hook

  if (mem == 0)                              /* free(0) has no effect */
    return;

  p = mem2chunk (mem);

  if (chunk_is_mmapped (p))                       /* release mmapped memory. */
    {
      /* see if the dynamic brk/mmap threshold needs adjusting */
      if (!mp_.no_dyn_threshold
          && p->size > mp_.mmap_threshold
          && p->size <= DEFAULT_MMAP_THRESHOLD_MAX)
        {
          mp_.mmap_threshold = chunksize (p);
          mp_.trim_threshold = 2 * mp_.mmap_threshold;
          LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,
                      mp_.mmap_threshold, mp_.trim_threshold);
        }
      munmap_chunk (p);
      return;
    }

  ar_ptr = arena_for_chunk (p);
  _int_free (ar_ptr, p, 0);
}
_int_free
一些安全检查
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
size = chunksize (p);
//筛掉一些特别大的chunk（超出内存边界）
  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)
      || __builtin_expect (misaligned_chunk (p), 0))
    {
      errstr = "free(): invalid pointer";
    errout:
      if (!have_lock && locked)
        (void) mutex_unlock (&av->mutex);
      malloc_printerr (check_action, errstr, chunk2mem (p), av);
      return;
    }
//对齐检查
  if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size)))
    {
      errstr = "free(): invalid size";
      goto errout;
    }

//仅当定义了MALLOC_DEBUG时使用
  check_inuse_chunk(av, p);
chunk在fastbin范围内且下一个chunk不是top chunk
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
  if ((unsigned long)(size) <= (unsigned long)(get_max_fast ())

#if TRIM_FASTBINS
      /*
	If TRIM_FASTBINS set, don't place chunks
	bordering top into fastbins
      */
      && (chunk_at_offset(p, size) != av->top)
#endif
      ) {

//下一个chunk的size合法
    if (__builtin_expect (chunk_at_offset (p, size)->size <= 2 * SIZE_SZ, 0)
	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
			     >= av->system_mem, 0))
      {
	/* We might not have a lock at this point and concurrent modifications
	   of system_mem might have let to a false positive.  Redo the test
	   after getting the lock.  */
	if (have_lock
	    || ({ assert (locked == 0);
		  mutex_lock(&av->mutex);
		  locked = 1;
		  chunk_at_offset (p, size)->size <= 2 * SIZE_SZ
		    || chunksize (chunk_at_offset (p, size)) >= av->system_mem;
	      }))
	  {
	    errstr = "free(): invalid next size (fast)";
	    goto errout;
	  }
	if (! have_lock)
	  {
	    (void)mutex_unlock(&av->mutex);
	    locked = 0;
	  }
      }

//释放前user data填充为perturb_byte（0）
    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);

    set_fastchunks(av);
    unsigned int idx = fastbin_index(size);
    fb = &fastbin (av, idx);

//原子操作将chunk插入fast bin
    mchunkptr old = *fb, old2;
    unsigned int old_idx = ~0u;
    do
      {
//检查fastbin的第一个chunk是不是插入的chunk（double free检查）
	if (__builtin_expect (old == p, 0))
	  {
	    errstr = "double free or corruption (fasttop)";
	    goto errout;
	  }

	if (have_lock && old != NULL)
	  old_idx = fastbin_index(chunksize(old));
	p->fd = old2 = old;
      }
    while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2)) != old2);

    if (have_lock && old != NULL && __builtin_expect (old_idx != idx, 0))
      {
	errstr = "invalid fastbin entry (free)";
	goto errout;
      }
  }
非mmap的chunk，先是一些安全检查
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
else if (!chunk_is_mmapped(p)) {
    if (! have_lock) {
      (void)mutex_lock(&av->mutex);
      locked = 1;
    }

    nextchunk = chunk_at_offset(p, size);

//不是top chunk
    if (__glibc_unlikely (p == av->top))
      {
	errstr = "double free or corruption (top)";
	goto errout;
      }

//nextchunk越界
    if (__builtin_expect (contiguous (av)
			  && (char *) nextchunk
			  >= ((char *) av->top + chunksize(av->top)), 0))
      {
	errstr = "double free or corruption (out)";
	goto errout;
      }

//nextchunk的preinuse检查chunk是否在使用（double free检查）
    if (__glibc_unlikely (!prev_inuse(nextchunk)))
      {
	errstr = "double free or corruption (!prev)";
	goto errout;
      }

//nextsize合法检查
    nextsize = chunksize(nextchunk);
    if (__builtin_expect (nextchunk->size <= 2 * SIZE_SZ, 0)
	|| __builtin_expect (nextsize >= av->system_mem, 0))
      {
	errstr = "free(): invalid next size (normal)";
	goto errout;
      }



	……



}
chunk合并

先向下合并再向上合并

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);

//向下合并
    if (!prev_inuse(p)) {
      prevsize = p->prev_size;
      size += prevsize;
      p = chunk_at_offset(p, -((long) prevsize));
      unlink(av, p, bck, fwd);
    }

//上面不是top chunk
    if (nextchunk != av->top) {
      /* get and clear inuse bit */
      nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

      /* consolidate forward */
      if (!nextinuse) {//向上合并
	unlink(av, nextchunk, bck, fwd);
	size += nextsize;
      } else
	clear_inuse_bit_at_offset(nextchunk, 0);

//放入unsorted bin

      bck = unsorted_chunks(av);
      fwd = bck->fd;
//检查unsorted bin第一个chunk的连接是否正确
      if (__glibc_unlikely (fwd->bk != bck))
	{
	  errstr = "free(): corrupted unsorted chunks";
	  goto errout;
	}
      p->fd = fwd;
      p->bk = bck;
      if (!in_smallbin_range(size))
	{
	  p->fd_nextsize = NULL;
	  p->bk_nextsize = NULL;
	}
      bck->fd = p;
      fwd->bk = p;

      set_head(p, size | PREV_INUSE);
      set_foot(p, size);

      check_free_chunk(av, p);
    }

    /*
      If the chunk borders the current high end of memory,
      consolidate into top
    */

    else {//如果上一个是top chunk，和top chunk合并
      size += nextsize;
      set_head(p, size | PREV_INUSE);
      av->top = p;
      check_chunk(av, p);
    }
后续操作

合并后如果chunk超过了FASTBIN_CONSOLIDATION_THRESHOLD，整理fast bin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
    if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {
      if (have_fastchunks(av))
	malloc_consolidate(av);

//以下为返回内存操作
      if (av == &main_arena) {
#ifndef MORECORE_CANNOT_TRIM
	if ((unsigned long)(chunksize(av->top)) >=
	    (unsigned long)(mp_.trim_threshold))
	  systrim(mp_.top_pad, av);
#endif
      } else {
	/* Always try heap_trim(), even if the top chunk is not
	   large, because the corresponding heap might go away.  */
	heap_info *heap = heap_for_ptr(top(av));

	assert(heap->ar_ptr == av);
	heap_trim(heap, mp_.top_pad);
      }
    }

    if (! have_lock) {
      assert (locked);
      (void)mutex_unlock(&av->mutex);
    }
  }
  /*
    If the chunk was allocated via mmap, release via munmap().
  */

  else {
    munmap_chunk (p);
  }

malloc_consolidate

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
static void malloc_consolidate(mstate av)
{
  mfastbinptr*    fb;                 /* current fastbin being consolidated */
  mfastbinptr*    maxfb;              /* last fastbin (for loop control) */
  mchunkptr       p;                  /* current chunk being consolidated */
  mchunkptr       nextp;              /* next chunk to consolidate */
  mchunkptr       unsorted_bin;       /* bin header */
  mchunkptr       first_unsorted;     /* chunk to link to */

  /* These have same use as in free() */
  mchunkptr       nextchunk;
  INTERNAL_SIZE_T size;
  INTERNAL_SIZE_T nextsize;
  INTERNAL_SIZE_T prevsize;
  int             nextinuse;
  mchunkptr       bck;
  mchunkptr       fwd;

  if (get_max_fast () != 0) {
    clear_fastchunks(av);
//清楚av->flags有关fast bin的标志位，表示fast bin为空

    unsorted_bin = unsorted_chunks(av);

    maxfb = &fastbin (av, NFASTBINS - 1);
    fb = &fastbin (av, 0);
    do {
      p = atomic_exchange_acq (fb, 0);
      if (p != 0) {
	do {
	  check_inuse_chunk(av, p);
	  nextp = p->fd;

	  /* Slightly streamlined version of consolidation code in free() */
	  size = p->size & ~(PREV_INUSE|NON_MAIN_ARENA);
	  nextchunk = chunk_at_offset(p, size);
	  nextsize = chunksize(nextchunk);

	  if (!prev_inuse(p)) {
	    prevsize = p->prev_size;
	    size += prevsize;
	    p = chunk_at_offset(p, -((long) prevsize));
	    unlink(av, p, bck, fwd);
	  }

	  if (nextchunk != av->top) {
	    nextinuse = inuse_bit_at_offset(nextchunk, nextsize);

	    if (!nextinuse) {
	      size += nextsize;
	      unlink(av, nextchunk, bck, fwd);
	    } else
	      clear_inuse_bit_at_offset(nextchunk, 0);

	    first_unsorted = unsorted_bin->fd;
	    unsorted_bin->fd = p;
	    first_unsorted->bk = p;

	    if (!in_smallbin_range (size)) {
	      p->fd_nextsize = NULL;
	      p->bk_nextsize = NULL;
	    }

	    set_head(p, size | PREV_INUSE);
	    p->bk = unsorted_bin;
	    p->fd = first_unsorted;
	    set_foot(p, size);
	  }

	  else {
	    size += nextsize;
	    set_head(p, size | PREV_INUSE);
	    av->top = p;
	  }

	} while ( (p = nextp) != 0);

      }
    } while (fb++ != maxfb);
//遍历fastbin的每一条链和每一个chunk，合并整理同上
  }
  else {
    malloc_init_state(av);
    check_malloc_state(av);
  }//如果max_fast==0，则初始化av
}
CTF > pwn > heap
#源码 #ptmalloc2
2.23堆相关源码阅读笔记
http://akaieurus.github.io/2023/01/20/堆相关源码阅读笔记/
作者
Eurus
发布于
2023年1月20日
许可协议