java-topology/docs/tickets/memcached-0001-slabs-clsid-linear-scan.md

memcached-0001: slabs_clsid() O(n) linear scan over sorted array

Target: memcached/memcached Severity: MEDIUM CWE: CWE-407 (Inefficient Algorithmic Complexity) File: slabs.c:77 (slabs_clsid) Status: PATCHED

Description

slabs_clsid(size_t size) finds the smallest slab class whose chunk size accommodates the requested allocation. The slab class array (slabclass[]) is sorted in ascending order of size. The current implementation walks it linearly with a while loop.

unsigned int slabs_clsid(const size_t size) {
    int res = POWER_SMALLEST;
    if (size == 0 || size > settings.item_size_max)
        return 0;
    while (size > slabclass[res].size)
        if (res++ == power_largest)
            return power_largest;
    return res;
}

power_largest reaches up to 63 (MAX_NUMBER_OF_SLAB_CLASSES − 1 = 63). Binary search over a sorted array of 63 entries requires at most 6 comparisons (⌈log₂(63)⌉ = 6) vs. up to 63 comparisons in the linear case — a ~10× speedup.

slabs_clsid is called on every item allocation:

• do_item_alloc — called for every SET / ADD / REPLACE / APPEND / PREPEND / CAS command
• do_item_alloc_chunk — called per chunk of large items
• item_store_check — called during SET pre-validation

Under high write throughput this is a hot path: a 200k SET/s workload calls slabs_clsid ~200,000 times per second.

Fix

Replace the while loop with a binary search over slabclass[1..power_largest]:

unsigned int slabs_clsid(const size_t size) {
    if (size == 0 || size > settings.item_size_max)
        return 0;
    int lo = POWER_SMALLEST, hi = power_largest;
    while (lo < hi) {
        int mid = lo + (hi - lo) / 2;
        if (slabclass[mid].size < size)
            lo = mid + 1;
        else
            hi = mid;
    }
    return lo;
}

This is safe because slabclass[].size is strictly monotonically increasing (guaranteed by the slabs_init construction loop).

See patch: defects/memcached/patch/0001-slabs-clsid-binary-search.patch

Ops ratio (unit test)

63 slab classes, query for the largest size:

• slow ops: 63 (linear scan)
• fast ops: 6 (binary search, ⌈log₂(63)⌉)
• speedup: 10.5×