The Bins: malloc's Free Lists
- tcache (per-thread): small, fast, single-linked LIFO cache. First stop for small allocations (glibc 2.26+).
- Fast bins: single-linked LIFO lists for small chunks; chunks are not coalesced, kept ready for quick reuse.
- Unsorted bin: a temporary holding list; recently freed larger chunks land here before being sorted.
- Small bins: double-linked lists, one exact size per bin.
- Large bins: double-linked lists holding ranges of sizes, kept sorted.
Allocation order (roughly): tcache, then fast bins, then unsorted /
small / large, then split the top chunk (the wilderness).
Key Takeaway
Each bin type has different metadata and different checks — each is a distinct attack surface.