From 22a05b4a3cad6c37e9cce798b30374c085ca6833 Mon Sep 17 00:00:00 2001 From: Nathaniel Wesley Filardo Date: Thu, 11 Nov 2021 14:46:52 +0000 Subject: [PATCH] CHERI: dealloc() use cap base, not address --- src/mem/localalloc.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/mem/localalloc.h b/src/mem/localalloc.h index b243290..b556d77 100644 --- a/src/mem/localalloc.h +++ b/src/mem/localalloc.h @@ -464,6 +464,24 @@ namespace snmalloc // before init, that maps null to a remote_deallocator that will never // be in thread local state. +# ifdef __CHERI_PURE_CAPABILITY__ + /* + * On CHERI platforms, snap the provided pointer to its base, ignoring + * any client-provided offset, which may have taken the pointer out of + * bounds and so appear to designate a different object. The base is + * is guaranteed by monotonicity either... + * * to be within the bounds originally returned by alloc(), or + * * one past the end (in which case, the capability length must be 0). + * + * Setting the offset does not trap on untagged capabilities, so the tag + * might be clear after this, as well. + * + * For a well-behaved client, this is a no-op: the base is already at the + * start of the allocation and so the offset is zero. + */ + p_raw = __builtin_cheri_offset_set(p_raw, 0); +# endif + capptr::AllocWild p_wild = capptr_from_client(p_raw); /*