commit 934f8880b6d5d7cd44ec370c080da015ae819bb4
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Wed Jul 30 01:55:22 2025 +0200

    malloc: Make sure tcache_key is not 0
    
    Othersize even if tcache_double_free_verify sets e->key to 0 before
    calling __libc_free, it gets called again by __libc_free, thus looping
    indefinitely.
    
    Fixes: c968fe50628db74b52124d863cd828225a1d305c ("malloc: Use tailcalls in __libc_free")

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 5ca390cc22..970717eb28 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3152,6 +3152,9 @@ tcache_key_initialize (void)
   if (__getrandom_nocancel_nostatus_direct (&tcache_key, sizeof(tcache_key),
 					    GRND_NONBLOCK)
       != sizeof (tcache_key))
+    tcache_key = 0;
+
+  while (tcache_key == 0)
     {
       tcache_key = random_bits ();
 #if __WORDSIZE == 64