jmb
/
hardened_malloc
mirror of https://github.com/GrapheneOS/hardened_malloc.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

mte: disable slab canaries when MTE is on 

Canary with the "0" value is now reserved to support re-enabling slab canaries if MTE is turned off
at runtime.
pull/226/head
Dmitry Muhomor 2023-10-26 10:19:20 +03:00 committed by Daniel Micay
parent 70c91f4c3e
commit 001fc86585
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
h_malloc.c
View File

@ -484,19 +484,43 @@ static void set_slab_canary_value(UNUSED struct slab_metadata *metadata, UNUSED
0x00ffffffffffffffUL; 0x00ffffffffffffffUL;
metadata->canary_value = get_random_u64(rng) & canary_mask; metadata->canary_value = get_random_u64(rng) & canary_mask;
#ifdef HAS_ARM_MTE
if (unlikely(metadata->canary_value == 0)) {
metadata->canary_value = 0x100;
}
#endif
#endif #endif
} }
static void set_canary(UNUSED const struct slab_metadata *metadata, UNUSED void *p, UNUSED size_t size) { static void set_canary(UNUSED const struct slab_metadata *metadata, UNUSED void *p, UNUSED size_t size) {
#if SLAB_CANARY #if SLAB_CANARY
#ifdef HAS_ARM_MTE
if (likely(is_memtag_enabled())) {
return;
}
#endif
memcpy((char *)p + size - canary_size, &metadata->canary_value, canary_size); memcpy((char *)p + size - canary_size, &metadata->canary_value, canary_size);
#endif #endif
} }
static void check_canary(UNUSED const struct slab_metadata *metadata, UNUSED const void *p, UNUSED size_t size) { static void check_canary(UNUSED const struct slab_metadata *metadata, UNUSED const void *p, UNUSED size_t size) {
#if SLAB_CANARY #if SLAB_CANARY
#ifdef HAS_ARM_MTE
if (likely(is_memtag_enabled())) {
return;
}
#endif
u64 canary_value; u64 canary_value;
memcpy(&canary_value, (const char *)p + size - canary_size, canary_size); memcpy(&canary_value, (const char *)p + size - canary_size, canary_size);
#ifdef HAS_ARM_MTE
if (unlikely(canary_value == 0)) {
return;
}
#endif
if (unlikely(canary_value != metadata->canary_value)) { if (unlikely(canary_value != metadata->canary_value)) {
fatal_error("canary corrupted"); fatal_error("canary corrupted");
} }