From: Topi Miettinen <toiwoton@gmail.com>
To: libc-alpha@sourceware.org
Cc: Topi Miettinen <toiwoton@gmail.com>
Subject: [PATCH 2/3] malloc: use mmap() to improve ASLR
Date: Wed, 25 Nov 2020 13:36:31 +0200 [thread overview]
Message-ID: <20201125113632.6486-3-toiwoton@gmail.com> (raw)
In-Reply-To: <20201125113632.6486-1-toiwoton@gmail.com>
sbrk() returns rather predictable allocations because they are located
close to the data segment. Let's use mmap() instead, except if
instructed by a tunable.
--
v2: use tunable
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
malloc/arena.c | 11 +++++++++--
malloc/morecore.c | 10 ++++++++++
2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/malloc/arena.c b/malloc/arena.c
index 202daf15b0..129e231bae 100644
--- a/malloc/arena.c
+++ b/malloc/arena.c
@@ -295,14 +295,21 @@ ptmalloc_init (void)
#ifdef SHARED
/* In case this libc copy is in a non-default namespace, never use brk.
- Likewise if dlopened from statically linked program. */
+ Likewise if dlopened from statically linked program.
+ Otherwise the use of brk is controlled by a tunable
+ glibc.malloc.use_sbrk. */
Dl_info di;
struct link_map *l;
if (_dl_open_hook != NULL
|| (_dl_addr (ptmalloc_init, &di, &l, NULL) != 0
- && l->l_ns != LM_ID_BASE))
+ && l->l_ns != LM_ID_BASE)
+#if HAVE_TUNABLES
+ || !TUNABLE_GET (use_sbrk, int32_t, NULL)
+#endif
+ )
__morecore = __failing_morecore;
+
#endif
thread_arena = &main_arena;
diff --git a/malloc/morecore.c b/malloc/morecore.c
index 72e655f84f..d5da5ffc45 100644
--- a/malloc/morecore.c
+++ b/malloc/morecore.c
@@ -38,12 +38,22 @@ libc_hidden_proto (__sbrk)
# define NULL 0
#endif
+#if HAVE_TUNABLES
+# define TUNABLE_NAMESPACE malloc
+#endif
+#include <elf/dl-tunables.h>
+
/* Allocate INCREMENT more bytes of data space,
and return the start of data space, or NULL on errors.
If INCREMENT is negative, shrink data space. */
void *
__default_morecore (ptrdiff_t increment)
{
+ /* Tunable glibc.malloc.use_sbrk controls use of 'sbrk()'. */
+#if HAVE_TUNABLES
+ if (!TUNABLE_GET (use_sbrk, int32_t, NULL))
+ return NULL;
+#endif
void *result = (void *) __sbrk (increment);
if (result == (void *) -1)
return NULL;
--
2.29.2
next prev parent reply other threads:[~2020-11-25 11:36 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-25 11:36 [PATCH 0/3] Improved ASLR Topi Miettinen
2020-11-25 11:36 ` [PATCH 1/3] csu: randomize location of TCB Topi Miettinen
2020-11-25 13:18 ` Adhemerval Zanella
2020-11-25 13:43 ` Topi Miettinen
2020-11-25 17:49 ` Topi Miettinen
2020-11-25 11:36 ` Topi Miettinen [this message]
2020-11-25 11:36 ` [PATCH 3/3] dl-sysdep: disable remaining calls to sbrk() Topi Miettinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201125113632.6486-3-toiwoton@gmail.com \
--to=toiwoton@gmail.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).