Cheri-research/snmalloc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SP: free lists and remote queues are CBAlloc

Browse Source 
Continue tightening the screws on pointer bounds.

Notably, pointers in remote queues are bounded to the free objects.  While we
believe that something like MTE is required to make in-band metadata safe, this
is a kind of defense in depth for StrictProvenance architectures: UAF for small
and medium objects expose mostly other (free) small or medium objects and not
allocator metadata (modulo some potential aliasing when Superslabs and
Mediumslabs interconvert).  This might shift the burdon on an attacker from
simply holding a UAF pointer to having had to farm several heap pointers.

The policy of bounding remote queue pointers may make the allocator's behavior
for small objects unexpected: while initial object construction during
allocation (that is, when the free list is empty) continues to cleave out
exportable pointers from elevated pointers to internal slabs, reuse pulls from
free lists of *already-bounded* objects.  These objects are queued by the
deallocation side, of course, but these paths now include "parallel
reconstruction" of a pointer to the free object from the amplified view of the
returned pointer, rather than queueing amplified pointers and leaving
reconstruction to the allocation side.

Medium objects are possibly similarly mysterious with the added twist that
medium slabs do not store pointers but rather always cleave from their
self-reference (but their interface has always operated using pointers).
Nevertheless, pointers to medium objects end up in remote queues, so we continue
to engage in "parallel reconstruction" in the deallocation paths.
This commit is contained in:
Nathaniel Filardo
2021-03-13 18:21:35 +00:00
committed by Nathaniel Wesley Filardo
parent cf50fc5e55
commit 95871ff8a1
6 changed files with 101 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/mem/remoteallocator.h
View File

@@ -18,8 +18,8 @@ namespace snmalloc
using alloc_id_t = size_t;
union
{
CapPtr<Remote, CBArena> non_atomic_next;
AtomicCapPtr<Remote, CBArena> next{nullptr};
CapPtr<Remote, CBAlloc> non_atomic_next;
AtomicCapPtr<Remote, CBAlloc> next{nullptr};
};
/*
@@ -72,7 +72,7 @@ namespace snmalloc
// Store the message queue on a separate cacheline. It is mutable data that
// is read by other threads.
alignas(CACHELINE_SIZE)
MPSCQ<Remote, CapPtrCBArena, AtomicCapPtrCBArena> message_queue;
MPSCQ<Remote, CapPtrCBAlloc, AtomicCapPtrCBAlloc> message_queue;
alloc_id_t trunc_id()
{