[PATCH] malloc: Improve tcache double-free detection

[Wilco Dijkstra]

Hi Ben,

As a general comment, do have performance results of your recent malloc
changes? Do you use a methodology to decide the performance vs security
tradeoffs?

Malloc is performance critical, and these changes affect key critical paths, so
we have to be sure the extra checks are either very low cost or bring essential
security gains.

> Chunks in the tcache have a pseudorandom key written into them during
> tcache_put. This patch adds a check to ensure that the key is still
> there when that chunk is taken by tcache_get. This provides 2 main
> benefits:
> 1. malloc can now often detect when a tcache chunk has been double-
>   freed across 2 threads. (https://pastebin.com/GSaExsQm)
> 2. In some scenarios, the key will behave like a canary, which should
>   catch some OOB writes and UAFs. (https://pastebin.com/xQbqpb9g)

Note this only works if the tcache is never full - it's tiny, and when you overflow
to fastbin the multiple free detection fails. Also I am wondering whether the
pointer swizzling will already detect most of these cases already? Why do we
have 2 separate mechanisms that try to detect almost the same cases here?

In the future, I believe reserving a common field in the header for all block
types would enable more general detection of double free and buffer overwrites.

Cheers,
Wilco