mirror of
				https://github.com/GrapheneOS/hardened_malloc.git
				synced 2025-11-04 01:36:33 +01:00 
			
		
		
		
	Compare commits
	
		
			6 commits
		
	
	
		
			ed604aa2d1
			...
			665581a41e
		
	
	| Author | SHA1 | Date | |
|---|---|---|---|
| 
							 | 
						665581a41e | ||
| 
							 | 
						5deea96fe1 | ||
| 
							 | 
						e371736b17 | ||
| 
							 | 
						c46d3cab33 | ||
| 
							 | 
						33ed3027ab | ||
| 
							 | 
						86dde60fcf | 
					 5 changed files with 11 additions and 9 deletions
				
			
		
							
								
								
									
										6
									
								
								.github/workflows/build-and-test.yml
									
										
									
									
										vendored
									
									
								
							
							
						
						
									
										6
									
								
								.github/workflows/build-and-test.yml
									
										
									
									
										vendored
									
									
								
							| 
						 | 
					@ -11,7 +11,7 @@ jobs:
 | 
				
			||||||
    runs-on: ubuntu-latest
 | 
					    runs-on: ubuntu-latest
 | 
				
			||||||
    strategy:
 | 
					    strategy:
 | 
				
			||||||
      matrix:
 | 
					      matrix:
 | 
				
			||||||
        version: [12, 13, 14]
 | 
					        version: [14]
 | 
				
			||||||
    steps:
 | 
					    steps:
 | 
				
			||||||
      - uses: actions/checkout@v5
 | 
					      - uses: actions/checkout@v5
 | 
				
			||||||
      - name: Setting up gcc version
 | 
					      - name: Setting up gcc version
 | 
				
			||||||
| 
						 | 
					@ -24,11 +24,11 @@ jobs:
 | 
				
			||||||
    runs-on: ubuntu-latest
 | 
					    runs-on: ubuntu-latest
 | 
				
			||||||
    strategy:
 | 
					    strategy:
 | 
				
			||||||
      matrix:
 | 
					      matrix:
 | 
				
			||||||
        version: [14, 15, 16, 17, 18]
 | 
					        version: [19, 20]
 | 
				
			||||||
    steps:
 | 
					    steps:
 | 
				
			||||||
      - uses: actions/checkout@v5
 | 
					      - uses: actions/checkout@v5
 | 
				
			||||||
      - name: Install dependencies
 | 
					      - name: Install dependencies
 | 
				
			||||||
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang-14 clang-15
 | 
					        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends clang-19 clang-20
 | 
				
			||||||
      - name: Setting up clang version
 | 
					      - name: Setting up clang version
 | 
				
			||||||
        run: |
 | 
					        run: |
 | 
				
			||||||
          sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${{ matrix.version }} 100
 | 
					          sudo update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${{ matrix.version }} 100
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -159,8 +159,11 @@ line to the `/etc/ld.so.preload` configuration file:
 | 
				
			||||||
The format of this configuration file is a whitespace-separated list, so it's
 | 
					The format of this configuration file is a whitespace-separated list, so it's
 | 
				
			||||||
good practice to put each library on a separate line.
 | 
					good practice to put each library on a separate line.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
On Debian systems `libhardened_malloc.so` should be installed into `/usr/lib/`
 | 
					For maximum compatibility `libhardened_malloc.so` can be installed into
 | 
				
			||||||
to avoid preload failures caused by AppArmor profile restrictions.
 | 
					`/usr/lib/` to avoid preload failures caused by AppArmor profiles or systemd
 | 
				
			||||||
 | 
					ExecPaths= restrictions. Check for logs of the following format:
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					    ERROR: ld.so: object '/usr/local/lib/libhardened_malloc.so' from /etc/ld.so.preload cannot be preloaded (failed to map segment from shared object): ignored.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
Using the `LD_PRELOAD` environment variable to load it on a case-by-case basis
 | 
					Using the `LD_PRELOAD` environment variable to load it on a case-by-case basis
 | 
				
			||||||
will not work when `AT_SECURE` is set such as with setuid binaries. It's also
 | 
					will not work when `AT_SECURE` is set such as with setuid binaries. It's also
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -44,7 +44,7 @@ void *set_pointer_tag(void *ptr, u8 tag) {
 | 
				
			||||||
    return (void *) (((uintptr_t) tag << 56) | (uintptr_t) untag_pointer(ptr));
 | 
					    return (void *) (((uintptr_t) tag << 56) | (uintptr_t) untag_pointer(ptr));
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
// This test checks that slab slot allocation uses tag that is distint from tags of its neighbors
 | 
					// This test checks that slab slot allocation uses tag that is distinct from tags of its neighbors
 | 
				
			||||||
// and from the tag of the previous allocation that used the same slot
 | 
					// and from the tag of the previous allocation that used the same slot
 | 
				
			||||||
void tag_distinctness() {
 | 
					void tag_distinctness() {
 | 
				
			||||||
    // tag 0 is reserved
 | 
					    // tag 0 is reserved
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -414,8 +414,7 @@ static size_t get_free_slot(struct random_state *rng, size_t slots, const struct
 | 
				
			||||||
        size_t first_bitmap = random_index / U64_WIDTH;
 | 
					        size_t first_bitmap = random_index / U64_WIDTH;
 | 
				
			||||||
#pragma GCC diagnostic push
 | 
					#pragma GCC diagnostic push
 | 
				
			||||||
#pragma GCC diagnostic ignored "-Wundef"
 | 
					#pragma GCC diagnostic ignored "-Wundef"
 | 
				
			||||||
// __BMI2__ is idiomatic to gcc unfortunately.
 | 
					#if __x86_64__ && ((__GNU__ && __BMI2__ ) || (__clang__ && __BMI2INTRIN_H_))
 | 
				
			||||||
#if __x86_64__ && (__BMI2__ || (__clang__ && __BMI2INTRIN_H_))
 | 
					 | 
				
			||||||
#pragma GCC diagnostic pop
 | 
					#pragma GCC diagnostic pop
 | 
				
			||||||
        u64 random_split = ~(~0UL << _pext_u64(random_index, 8));
 | 
					        u64 random_split = ~(~0UL << _pext_u64(random_index, 8));
 | 
				
			||||||
#else
 | 
					#else
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -98,7 +98,7 @@ class TestSimpleMemoryCorruption(unittest.TestCase):
 | 
				
			||||||
        self.assertEqual(stderr.decode("utf-8"),
 | 
					        self.assertEqual(stderr.decode("utf-8"),
 | 
				
			||||||
                         "fatal allocator error: invalid free\n")
 | 
					                         "fatal allocator error: invalid free\n")
 | 
				
			||||||
 | 
					
 | 
				
			||||||
    def test_invalid_malloc_usable_size_small_quarantene(self):
 | 
					    def test_invalid_malloc_usable_size_small_quarantine(self):
 | 
				
			||||||
        _stdout, stderr, returncode = self.run_test(
 | 
					        _stdout, stderr, returncode = self.run_test(
 | 
				
			||||||
            "invalid_malloc_usable_size_small_quarantine")
 | 
					            "invalid_malloc_usable_size_small_quarantine")
 | 
				
			||||||
        self.assertEqual(returncode, -6)
 | 
					        self.assertEqual(returncode, -6)
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
	Add table
		
		Reference in a new issue