commit 7a9368a1174cb15b9f1d6342e0e10dd90dae238d
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Nov 15 11:39:01 2017 +0100

    malloc: Add missing arena lock in malloc_info [BZ #22408]
    
    Obtain the size information while the arena lock is acquired, and only
    print it later.

Conflicts:
	malloc/Makefile
	  (Differences in available tests.)

diff --git a/malloc/Makefile b/malloc/Makefile
index 992cec6b03115a76..6f216f423293dc6c 100644
--- a/malloc/Makefile
+++ b/malloc/Makefile
@@ -31,6 +31,7 @@ tests := mallocbug tst-malloc tst-valloc tst-calloc tst-obstack \
 	 tst-malloc-thread-fail tst-malloc-fork-deadlock \
 	 tst-interpose-nothread \
 	 tst-interpose-thread \
+	 tst-malloc_info \
 	 tst-interpose-static-nothread \
 	 tst-interpose-static-thread \
 	 tst-scratch_buffer \
@@ -214,3 +215,5 @@ $(objpfx)tst-dynarray-mem: $(objpfx)tst-dynarray.out
 tst-dynarray-fail-ENV = MALLOC_TRACE=$(objpfx)tst-dynarray-fail.mtrace
 $(objpfx)tst-dynarray-fail-mem: $(objpfx)tst-dynarray-fail.out
 	$(common-objpfx)malloc/mtrace $(objpfx)tst-dynarray-fail.mtrace > $@
+
+$(objpfx)tst-malloc_info: $(shared-thread-library)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index d2a5e251da4f1191..035f2167be7019d8 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -5108,6 +5108,15 @@ __malloc_info (int options, FILE *fp)
 	  avail += sizes[NFASTBINS - 1 + i].total;
 	}
 
+      size_t heap_size = 0;
+      size_t heap_mprotect_size = 0;
+      if (ar_ptr != &main_arena)
+	{
+	  heap_info *heap = heap_for_ptr (top (ar_ptr));
+	  heap_size = heap->size;
+	  heap_mprotect_size = heap->mprotect_size;
+	}
+
       __libc_lock_unlock (ar_ptr->mutex);
 
       total_nfastblocks += nfastblocks;
@@ -5141,13 +5150,12 @@ __malloc_info (int options, FILE *fp)
 
       if (ar_ptr != &main_arena)
 	{
-	  heap_info *heap = heap_for_ptr (top (ar_ptr));
 	  fprintf (fp,
 		   "<aspace type=\"total\" size=\"%zu\"/>\n"
 		   "<aspace type=\"mprotect\" size=\"%zu\"/>\n",
-		   heap->size, heap->mprotect_size);
-	  total_aspace += heap->size;
-	  total_aspace_mprotect += heap->mprotect_size;
+		   heap_size, heap_mprotect_size);
+	  total_aspace += heap_size;
+	  total_aspace_mprotect += heap_mprotect_size;
 	}
       else
 	{
diff --git a/malloc/tst-malloc_info.c b/malloc/tst-malloc_info.c
new file mode 100644
index 0000000000000000..a25b8cbeae78e710
--- /dev/null
+++ b/malloc/tst-malloc_info.c
@@ -0,0 +1,101 @@
+/* Smoke test for malloc_info.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+/* The purpose of this test is to provide a quick way to run
+   malloc_info in a multi-threaded process.  */
+
+#include <array_length.h>
+#include <malloc.h>
+#include <stdlib.h>
+#include <support/support.h>
+#include <support/xthread.h>
+
+/* This barrier is used to have the main thread wait until the helper
+   threads have performed their allocations.  */
+static pthread_barrier_t barrier;
+
+enum
+  {
+    /* Number of threads performing allocations.  */
+    thread_count  = 4,
+
+    /* Amount of memory allocation per thread.  This should be large
+       enough to cause the allocation of multiple heaps per arena.  */
+    per_thread_allocations
+      = sizeof (void *) == 4 ? 16 * 1024 * 1024 : 128 * 1024 * 1024,
+  };
+
+static void *
+allocation_thread_function (void *closure)
+{
+  struct list
+  {
+    struct list *next;
+    long dummy[4];
+  };
+
+  struct list *head = NULL;
+  size_t allocated = 0;
+  while (allocated < per_thread_allocations)
+    {
+      struct list *new_head = xmalloc (sizeof (*new_head));
+      allocated += sizeof (*new_head);
+      new_head->next = head;
+      head = new_head;
+    }
+
+  xpthread_barrier_wait (&barrier);
+
+  /* Main thread prints first statistics here.  */
+
+  xpthread_barrier_wait (&barrier);
+
+  while (head != NULL)
+    {
+      struct list *next_head = head->next;
+      free (head);
+      head = next_head;
+    }
+
+  return NULL;
+}
+
+static int
+do_test (void)
+{
+  xpthread_barrier_init (&barrier, NULL, thread_count + 1);
+
+  pthread_t threads[thread_count];
+  for (size_t i = 0; i < array_length (threads); ++i)
+    threads[i] = xpthread_create (NULL, allocation_thread_function, NULL);
+
+  xpthread_barrier_wait (&barrier);
+  puts ("info: After allocation:");
+  malloc_info (0, stdout);
+
+  xpthread_barrier_wait (&barrier);
+  for (size_t i = 0; i < array_length (threads); ++i)
+    xpthread_join (threads[i]);
+
+  puts ("\ninfo: After deallocation:");
+  malloc_info (0, stdout);
+
+  return 0;
+}
+
+#include <support/test-driver.c>