[PATCH v2 0/2] malloc: introduce ifuncs for malloc functions

[Wilco Dijkstra]

Hi Florian,

> I looked at this recently and it's rather desirable to tag chunks added
> to tcache so that they can be returned directly from a future malloc
> call.  This means that memory tagging cannot be implemented as a pure
> wrapper.

That's QoI. The existing implementation always untags and retags in tcache -
this allows detection of use after free (or double free) and using the chunk
for internal data.

You could retag only on free and not on malloc, but having chunk structs
that overlap user data makes all this tricky unfortunately. The tcache code
could in principle not use internal data or we could retag only the size of
the chunk struct. But we lose use-after-free/double-free checking if we
don't retag on every free. So it boils down to what level of security you want
vs the runtime overhead.

Cheers,
Wilco