--- /dev/null
+From: Florian Weimer <fweimer@redhat.com>
+Date: Wed, 15 Nov 2017 11:39:01 +0100
+Subject: [PATCH] malloc: Add missing arena lock in malloc_info [BZ #22408]
+
+Obtain the size information while the arena lock is acquired, and only
+print it later.
+
+Upstream-Status: Backport
+
+Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
+
+Index: git/malloc/Makefile
+===================================================================
+--- git.orig/malloc/Makefile 2017-09-04 17:34:06.758018978 +0800
++++ git/malloc/Makefile 2017-11-20 14:57:43.440337572 +0800
+@@ -35,6 +35,7 @@
+ tst-interpose-thread \
+ tst-alloc_buffer \
+ tst-malloc-tcache-leak \
++ tst-malloc_info \
+
+ tests-static := \
+ tst-interpose-static-nothread \
+@@ -245,3 +246,5 @@
+ $(evaluate-test)
+
+ $(objpfx)tst-malloc-tcache-leak: $(shared-thread-library)
++
++$(objpfx)tst-malloc_info: $(shared-thread-library)
+Index: git/malloc/malloc.c
+===================================================================
+--- git.orig/malloc/malloc.c 2017-09-04 17:34:06.758018978 +0800
++++ git/malloc/malloc.c 2017-11-20 15:01:02.412338959 +0800
+@@ -5547,6 +5547,15 @@
+ avail += sizes[NFASTBINS - 1 + i].total;
+ }
+
++ size_t heap_size = 0;
++ size_t heap_mprotect_size = 0;
++ if (ar_ptr != &main_arena)
++ {
++ heap_info *heap = heap_for_ptr (top (ar_ptr));
++ heap_size = heap->size;
++ heap_mprotect_size = heap->mprotect_size;
++ }
++
+ __libc_lock_unlock (ar_ptr->mutex);
+
+ total_nfastblocks += nfastblocks;
+@@ -5580,13 +5589,12 @@
+
+ if (ar_ptr != &main_arena)
+ {
+- heap_info *heap = heap_for_ptr (top (ar_ptr));
+ fprintf (fp,
+ "<aspace type=\"total\" size=\"%zu\"/>\n"
+ "<aspace type=\"mprotect\" size=\"%zu\"/>\n",
+- heap->size, heap->mprotect_size);
+- total_aspace += heap->size;
+- total_aspace_mprotect += heap->mprotect_size;
++ heap_size, heap_mprotect_size);
++ total_aspace += heap_size;
++ total_aspace_mprotect += heap_mprotect_size;
+ }
+ else
+ {
+Index: git/malloc/tst-malloc_info.c
+===================================================================
+--- /dev/null 1970-01-01 00:00:00.000000000 +0000
++++ git/malloc/tst-malloc_info.c 2017-11-20 15:02:03.208339383 +0800
+@@ -0,0 +1,101 @@
++/* Smoke test for malloc_info.
++ Copyright (C) 2017 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <http://www.gnu.org/licenses/>. */
++
++/* The purpose of this test is to provide a quick way to run
++ malloc_info in a multi-threaded process. */
++
++#include <array_length.h>
++#include <malloc.h>
++#include <stdlib.h>
++#include <support/support.h>
++#include <support/xthread.h>
++
++/* This barrier is used to have the main thread wait until the helper
++ threads have performed their allocations. */
++static pthread_barrier_t barrier;
++
++enum
++ {
++ /* Number of threads performing allocations. */
++ thread_count = 4,
++
++ /* Amount of memory allocation per thread. This should be large
++ enough to cause the allocation of multiple heaps per arena. */
++ per_thread_allocations
++ = sizeof (void *) == 4 ? 16 * 1024 * 1024 : 128 * 1024 * 1024,
++ };
++
++static void *
++allocation_thread_function (void *closure)
++{
++ struct list
++ {
++ struct list *next;
++ long dummy[4];
++ };
++
++ struct list *head = NULL;
++ size_t allocated = 0;
++ while (allocated < per_thread_allocations)
++ {
++ struct list *new_head = xmalloc (sizeof (*new_head));
++ allocated += sizeof (*new_head);
++ new_head->next = head;
++ head = new_head;
++ }
++
++ xpthread_barrier_wait (&barrier);
++
++ /* Main thread prints first statistics here. */
++
++ xpthread_barrier_wait (&barrier);
++
++ while (head != NULL)
++ {
++ struct list *next_head = head->next;
++ free (head);
++ head = next_head;
++ }
++
++ return NULL;
++}
++
++static int
++do_test (void)
++{
++ xpthread_barrier_init (&barrier, NULL, thread_count + 1);
++
++ pthread_t threads[thread_count];
++ for (size_t i = 0; i < array_length (threads); ++i)
++ threads[i] = xpthread_create (NULL, allocation_thread_function, NULL);
++
++ xpthread_barrier_wait (&barrier);
++ puts ("info: After allocation:");
++ malloc_info (0, stdout);
++
++ xpthread_barrier_wait (&barrier);
++ for (size_t i = 0; i < array_length (threads); ++i)
++ xpthread_join (threads[i]);
++
++ puts ("\ninfo: After deallocation:");
++ malloc_info (0, stdout);
++
++ return 0;
++}
++
++#include <support/test-driver.c>
