[PATCH] malloc: check tcache mem size in tcache_get_n to avoid arbitrary mem allocation

[Wilco Dijkstra]

Hi,

> I add a test, which will prove this check does avoid tcache arbitrary
> alloc.Use `gcc malloc/tst-tcache-arbitrary-alloc.c` and then`./a.out` is
> fine.

Thanks, having a test is always useful. This basically overwrites the freelist
with a correctly swizzled pointer to a fake block. Once an attacker can do that,
they can just as easily fake a correct chunk header and pass the extra check...
Note that it should trigger a check in free() since the size is corrupted.
If it is feasible for an attacker to break the swizzling, it would be best to improve
that in some way.

> those results were produced on my x86_64 laptop.
> I got these results by the follows commands, is that what you do?

I normally just build glibc and benchtests and then run each benchmark
a few times like:

time ./build/glibc/benchtests/bench-malloc-thread 1

> Use`tc_idx != chunksize_nomask(mem2chunk(e))` is not correct.
> `tc_idx` is obviously not size, so I need to convert tc_idx to size.

Sorry, I meant csize2tidx (chunksize_nomask(mem2chunk(e)).
It's a bit long but it reuses existing macros and needs fewer instructions.

> Using `chunksize_nomask` will return size with flags(0x91 for example).
> while tc_idx can not provide chunk flags, so I have to use
> `tidx2csize(tc_idx) != chunksize(mem2chunk(e))`.

csize2tidx will shift out those flags, so it doesn't matter.

> Also I notice that `libc_malloc2` is noinline, that might be a waste
> when USE_TCACHE is not on.Maybe alias malloc to __libc_malloc2 when
> USE_TCACHE is not on?

This is not an issue since we don't build GLIBC without tcache. I'm actually
thinking of removing all the USE_TCACHE since it's quite messy...

Cheers,
Wilco