0.13.5 --- a large allocation is a mapping, and a mapping is whole pages

[Sunrisepeak]

Every program on Windows that allocated 131,052 bytes or more wrote past the memory it had obtained. The overrun reached up to a page beyond the block, into the next heap block's header. The program went on until the heap next walked there, then stopped with an access violation or ended without a word.

musl's allocator obtains such an allocation as a mapping of its own, mmap(n + IB + UNIT), and uses the mapping up to the end of its last page:

• get_stride: the slot of an individually mapped allocation is maplen * 4096 - UNIT bytes, where maplen is the length rounded up to pages.
• enframe: the block starts at a cycling offset of up to slack units into the slot, so up to a page past the start.
• set_size: the slot's footer, *(uint32_t *)(end - 4), is written just below the end of the last page.

On Linux those bytes exist, because the kernel maps whole pages. This port's do_mmap obtained kal_alloc(len, 4096) for exactly len. Where kal_alloc hands out that length and no more, which is the process heap on Windows, the footer and the tail of the block lay beyond the allocation.

Measured under Wine, x86_64-windows-gnu, both profiles:

std::string grown by push_back:  196,607 bytes ok, 196,700 bytes: the program ends, exit 0, nothing more printed
operator new: 16 → 131072 held, then 262144, then delete 131072: ends at the delete
examples/malloc-large before this change:
  FAIL: the last page of a mapping reads as zero (8192)
  wine: Unhandled page fault on read access to FFFFFFFFFFFFFFFF

Found through lsp-mcpp. On windows-2022 its conformance runner, a release build over openkal-llvm-runtime 0.9.5, stopped with an access violation while reading a build tree with a file of about 200 KB.

• port/src/okm_syscall.c: SYS_mmap and SYS_munmap round the length up to whole pages, and a length that cannot be rounded is ENOMEM.
• examples/malloc-large observes three things, and CI runs it on every row:
  1. A mapping whose length ends inside a page: the rest of that page reads as zero and can be written, and blocks allocated beside it keep their contents.
  2. Blocks from half the threshold to 8 MB, each grown from the one before the way a string grows, with small allocations walking the heap between them.
  3. realloc across the threshold in both directions.
• 0.13.5, and the README's table row for it.

Measured locally: the probe passes on x86_64 Linux, and on x86_64-windows-gnu under Wine in dev and release. With the change, the string and operator new patterns above complete, as does a 300 KB read through std::istreambuf_iterator. Without it, the probe fails and then faults.