From 453a7d57e9440bd11bd0f5b8be91e87ddc0ac5f0 Mon Sep 17 00:00:00 2001 From: Nathaniel Wesley Filardo Date: Wed, 16 Mar 2022 09:43:32 +0000 Subject: [PATCH] backend: clobber MetaEntry-s in dealloc_chunk Otherwise these won't get updated until the small buddy allocator hands them off to the large buddy allocator (when they morph into being rbtree nodes) and so the frontend might get confused in the interim (including risk of UAF on double-free). --- src/backend/backend.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/backend/backend.h b/src/backend/backend.h index 703d0d2..cd25e86 100644 --- a/src/backend/backend.h +++ b/src/backend/backend.h @@ -305,11 +305,18 @@ namespace snmalloc { auto chunk = chunk_record->meta_common.chunk; + /* + * The backend takes possession of these chunks now, by disassociating + * any existing remote allocator and metadata structure. If + * interrogated, the sizeclass reported by the MetaEntry is 0, which has + * size 0. + */ + MetaEntry t(nullptr, MetaEntry::REMOTE_BACKEND_MARKER); + Pagemap::set_metaentry(address_cast(chunk), size, t); + local_state.get_meta_range()->dealloc_range( capptr::Chunk(chunk_record), PAGEMAP_METADATA_STRUCT_SIZE); - // TODO, should we set the sizeclass to something specific here? - local_state.object_range->dealloc_range(chunk, size); }