free(3) const void *

[Xi Ruoyao]

On Fri, 2024-01-26 at 19:40 +0100, Alejandro Colomar wrote:
> On Sat, Jan 27, 2024 at 02:36:09AM +0800, Xi Ruoyao wrote:
> > On Fri, 2024-01-26 at 19:23 +0100, Alejandro Colomar wrote:
> > > So, after Xi's reminder, I'll reformulate my suggestion to
> > > 
> > > 	[[gnu::access(none)]]
> > > 	void free(const void *p);
> > 
> > It may defeat glibc.malloc.perturb, which will fill the freed buffer
> > with some junk bytes to detect UAF more easily.  Without the access
> > attribute the compiler will (definitely) read these junk bytes from the
> > freed buffer and hopefully make the program fail in a catastrophic way,
> > but with the access attribute the compiler may reuse the previously read
> > value stored in some registers, causing the UAF slip away.
> > 
> > And glibc.malloc.perturb is an environment variable set at runtime, so
> > we cannot do it via some #if...
> 
> Hmmm, interesting.  Then please ignore the patch I sent a moment ago.
> :)

Back on the topic, IMO you may tell others to create wrappers like

[[gnu::access(none, 1)]] static inline void
aggressive_free (const void *p)
{
  (free) ((void *)p);
}
#define free(x) aggressive_free (x)

with some texts to explain all the caveats (like `free ("string
literal");` will be incorrectly accepted, and the glibc.malloc.perturb
or similar facilities in other malloc implementations, etc) in the man
page...  But for the standard and/or the libc header it's a different
story.  Anyway if such a wrapper is adopted widely it will be easier to
raise it to WG14 and Austin.


-- 
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University