Changeset 240193 in webkit

Timestamp:

Jan 18, 2019 7:27:29 PM (5 years ago)

Author:

keith_miller@apple.com

Message:

gigacage slide should randomize both start and end
​https://bugs.webkit.org/show_bug.cgi?id=193601

Reviewed by Yusuke Suzuki.

This patch makes it so that the gigacade slide has an arbitrary
distance from the end as well as the start. This is done by
picking a random size then based on that size picking an random
starting offset.

• bmalloc/Gigacage.h:
• bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):

Location:

trunk/Source/bmalloc

Files:

• ChangeLog (modified) (1 diff)
• bmalloc/Algorithm.h (modified) (1 diff)
• bmalloc/Gigacage.h (modified) (3 diffs)
• bmalloc/Heap.cpp (modified) (1 diff)

trunk/Source/bmalloc/ChangeLog

@@ +1 @@
+2019-01-18  Keith Miller  <keith_miller@apple.com>
+
+        gigacage slide should randomize both start and end
+        https://bugs.webkit.org/show_bug.cgi?id=193601
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch makes it so that the gigacade slide has an arbitrary
+        distance from the end as well as the start. This is done by
+        picking a random size then based on that size picking an random
+        starting offset.
+
+        * bmalloc/Gigacage.h:
+        * bmalloc/Heap.cpp:
+        (bmalloc::Heap::Heap):
+
 2019-01-18  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/bmalloc/bmalloc/Algorithm.h

@@ -100 +100 @@
 {
     BASSERT(isPowerOfTwo(divisor));
-    return reinterpret_cast<T>(mask(reinterpret_cast<uintptr_t>(x), ~(divisor - 1ul)));
+    static_assert(sizeof(T) == sizeof(uintptr_t), "sizeof(T) must be equal to sizeof(uintptr_t).");
+    return static_cast<T>(mask(static_cast<uintptr_t>(x), ~(divisor - 1ul)));
+}
+
+template<typename T> inline T* roundDownToMultipleOf(size_t divisor, T* x)
+{
+    BASSERT(isPowerOfTwo(divisor));
+    return reinterpret_cast<T*>(mask(reinterpret_cast<uintptr_t>(x), ~(divisor - 1ul)));
 }
 

trunk/Source/bmalloc/bmalloc/Gigacage.h

@@ -71 +71 @@
 constexpr size_t jsValueGigacageSize = 1 * bmalloc::Sizes::GB;
 constexpr size_t gigacageBasePtrsSize = 16 * bmalloc::Sizes::kB;
-constexpr size_t minimumCageSizeAfterSlide = bmalloc::Sizes::GB / 2;
+constexpr size_t maximumCageSizeReductionForSlide = bmalloc::Sizes::GB / 2;
 #define GIGACAGE_ALLOCATION_CAN_FAIL 1
 #else
@@ -77 +77 @@
 constexpr size_t jsValueGigacageSize = 16 * bmalloc::Sizes::GB;
 constexpr size_t gigacageBasePtrsSize = 4 * bmalloc::Sizes::kB;
-constexpr size_t minimumCageSizeAfterSlide = 4 * bmalloc::Sizes::GB;
+constexpr size_t maximumCageSizeReductionForSlide = 4 * bmalloc::Sizes::GB;
 #define GIGACAGE_ALLOCATION_CAN_FAIL 0
 #endif
@@ -91 +91 @@
 static_assert(bmalloc::isPowerOfTwo(primitiveGigacageSize), "");
 static_assert(bmalloc::isPowerOfTwo(jsValueGigacageSize), "");
-static_assert(primitiveGigacageSize > minimumCageSizeAfterSlide, "");
-static_assert(jsValueGigacageSize > minimumCageSizeAfterSlide, "");
+static_assert(primitiveGigacageSize > maximumCageSizeReductionForSlide, "");
+static_assert(jsValueGigacageSize > maximumCageSizeReductionForSlide, "");
 
 constexpr size_t gigacageSizeToMask(size_t size) { return size - 1; }

trunk/Source/bmalloc/bmalloc/Heap.cpp

@@ -63 +63 @@
         if (usingGigacage()) {
             RELEASE_BASSERT(gigacageBasePtr());
-            uint64_t random;
-            cryptoRandom(reinterpret_cast<unsigned char*>(&random), sizeof(random));
-            ptrdiff_t offset = random % (gigacageSize() - Gigacage::minimumCageSizeAfterSlide);
-            offset = reinterpret_cast<ptrdiff_t>(roundDownToMultipleOf(vmPageSize(), reinterpret_cast<void*>(offset)));
+            uint64_t random[2];
+            cryptoRandom(reinterpret_cast<unsigned char*>(random), sizeof(random));
+            size_t size = roundDownToMultipleOf(vmPageSize(), gigacageSize() - (random[0] % Gigacage::maximumCageSizeReductionForSlide));
+            ptrdiff_t offset = roundDownToMultipleOf(vmPageSize(), random[1] % (gigacageSize() - size));
             void* base = reinterpret_cast<unsigned char*>(gigacageBasePtr()) + offset;
-            m_largeFree.add(LargeRange(base, gigacageSize() - offset, 0, 0));
+            m_largeFree.add(LargeRange(base, size, 0, 0));
         }
 #endif