[PATCH 3/3] malloc: Remove currently broken memory tagging
Florian Weimer
fweimer@redhat.com
Fri May 8 16:29:43 GMT 2026
* Yury Khrustalev:
> Have you run it on a system that has HWCAP2_MTE? One thing that doesn't
> work is that calling free(ptr) results in a SIGSEGV if ptr is tagged and
> memory it points to is also tagged. But of course for this to happen the
> system should have HWCAP2_MTE, and Glibc (or your test) should do prctl
> syscall with PR_SET_TAGGED_ADDR_CTRL and then malloc should use mmap with
> PROT_MTE.
The HWCAP2 bit was set, and the prctl call succeeded. It was definitely
was not easy to get this point, though.
> If you manage to enable memory tagging in malloc correctly, a lot of
> malloc tests from the Glibc testsuite fail (due to similar segfaults
> resulting from tag mismatch).
I went back to my old notes, and found this (regarding test failures in
particular):
| There's some issue with the static startup code, and ldconfig from our
| RPM builds crashes (seems compiler flags dependent). The glibc debug
| malloc is completely broken because it calls mem2chunk on null
| pointers, for free(NULL) and realloc(NULL, size). That's not valid in
| MTE mode. Rebooting with MTE forced on in glibc (for dynamically
| linked binaries) resulted in a crash in lvm. But it was not as bad as
| I expected: podman and Go seem to be working.
I think this was with glibc-2.39-derived code, so a bit different from
the malloc in the current tree.
Thanks,
Florian
More information about the Libc-alpha
mailing list