From b3d26f52f7084c1f008b3c746c01db4f122f7879 Mon Sep 17 00:00:00 2001 From: Szabolcs Nagy Date: Wed, 7 Jul 2021 14:21:40 +0100 Subject: [PATCH] cheri: malloc: Disable pointer protection Such arithmetic invalidates capabilities so this security measure does not work for CHERI. Note: the architecture makes it hard to corrupt pointers in malloc metadata, but not impossible: current allocation bounds include the metadata and capabilities are not revoked after free. These issues can be fixed by a capability aware malloc. --- malloc/malloc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/malloc/malloc.c b/malloc/malloc.c index bd3c76ed310..062ca0dc0aa 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -341,8 +341,12 @@ Fatal glibc error: malloc assertion failure in %s: %s\n", It assumes a minimum page size of 4096 bytes (12 bits). Systems with larger pages provide less entropy, although the pointer mangling still works. */ +#ifdef __CHERI_PURE_CAPABILITY__ +#define PROTECT_PTR(pos, ptr) (ptr) +#else #define PROTECT_PTR(pos, ptr) \ ((__typeof (ptr)) ((((size_t) pos) >> 12) ^ ((size_t) ptr))) +#endif #define REVEAL_PTR(ptr) PROTECT_PTR (&ptr, ptr) /* -- 2.47.2