[PATCH] malloc: check tcache mem size in tcache_get_n to avoid arbitrary mem allocation

[DJ Delorie]

dbgbgtf <dudududumaxver@gmail.com> writes:
>> We need checks on both put and get, depending on the type of exploit
>> we're guarding against.
>
> Arbitrary mem allocation `always` comes from tcache_get_n, that's the
> best way to prevent arbitrary mem allocation.

Hacks that target corrupting or exploiting weaknesses in the chunk
overhead can happen at any time, which is why we have tests in both
malloc and free.  Thus, we should have checks in both tcache_get and
tcache_put (or the equivalent).  *Which* checks we should have there
depend on the exploit we're protecting against. and the cost of doing
the check.

> If you really want to add check in tcache_put, please ensure my
> testcase passes correctly.

Any patch should ensure that all test cases pass correctly, of course.

>> At some point, we have to assume if a hacker can do XYZ, they can do far
>> worse things without bothering to corrupt memory first.  Our protection
>> in tcache needs to balance risk vs performance, even more so than the
>> main malloc code.  By that I mean if we make tcache so paranoid that
>> it's slower than not using tcache, we've lost.
>
> Perhaps you consider tcache_get_n a hot path and are hesitant to add
> checks there due to potential performance impact.

Everything in malloc is performance sensitive ;-)

> But take a look at my benchmark results, I'd say the cost is acceptable.

Or at least, the cost is smaller than the noise in the benchmark.  It's
really hard to get a consistent benchmark run on modern systems.

> If possible, I would like to see your test results as well.

Me too, but I don't have any to share ;-)