Skip to content

ARM MTE: properly check the memory tag of small allocations for h_free/h_free_sized/h_free_aligned_sized during deallocation - #368

Open
rdevshp wants to merge 1 commit into
GrapheneOS:mainfrom
rdevshp:free_check_tag
Open

ARM MTE: properly check the memory tag of small allocations for h_free/h_free_sized/h_free_aligned_sized during deallocation#368
rdevshp wants to merge 1 commit into
GrapheneOS:mainfrom
rdevshp:free_check_tag

Conversation

@rdevshp

@rdevshp rdevshp commented Jul 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Properly check the memory tag of small allocations for h_free/h_free_sized/h_free_aligned_sized during deallocation.

@rdevshp rdevshp changed the title ARM MTE: properly check the memory tag of small allocations for h_free/h_free_sized/h_free_aligned_sized ARM MTE: properly check the memory tag of small allocations for h_free/h_free_sized/h_free_aligned_sized during deallocation Jul 11, 2026
@rdevshp

rdevshp commented Jul 26, 2026

Copy link
Copy Markdown
Contributor Author

ping

@thestinger

thestinger commented Jul 27, 2026

Copy link
Copy Markdown
Member

It should be possible to do this with regular tag checks instead of our array of tags. Not sure which would be more efficient.

@rdevshp

rdevshp commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

It should be possible to do this with regular tag checks instead of our array of tags. Not sure which would be more efficient.

I did some local benchmarks, and it looks like using __arm_mte_get_tag is either better or equal to reading from the metadata array of tags in terms of performance. I have switched the patch to using __arm_mte_get_tag.

@rdevshp

rdevshp commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

There is an unrelated flaky CI issue caused by passing the combination of -Werror and -march=native flags to clang-19 (the build error was gone after I retriggered the CI). actions/runner-images#14296

Run CC=clang CXX=clang++ make test
mkdir -p out
clang  -std=c23 -pipe -O3 -flto -fPIC -fvisibility=hidden -fno-plt -fstack-clash-protection -fcf-protection -fstack-protector-strong -Wall -Wextra -Wcast-align -Wcast-qual -Wwrite-strings -Wundef -Werror -march=native -Wmissing-prototypes -Wstrict-prototypes  -D_GNU_SOURCE -I include -DCONFIG_SEAL_METADATA=false -DZERO_ON_FREE=true -DWRITE_AFTER_FREE_CHECK=true -DSLOT_RANDOMIZE=true -DSLAB_CANARY=true -DSLAB_QUARANTINE_RANDOM_LENGTH=1 -DSLAB_QUARANTINE_QUEUE_LENGTH=1 -DCONFIG_EXTENDED_SIZE_CLASSES=true -DCONFIG_LARGE_SIZE_CLASSES=true -DGUARD_SLABS_INTERVAL=1 -DGUARD_SIZE_DIVISOR=2 -DREGION_QUARANTINE_RANDOM_LENGTH=256 -DREGION_QUARANTINE_QUEUE_LENGTH=1024 -DREGION_QUARANTINE_SKIP_THRESHOLD=33554432  -DFREE_SLABS_QUARANTINE_RANDOM_LENGTH=32 -DCONFIG_CLASS_REGION_SIZE=34359738368  -DN_ARENA=4 -DCONFIG_STATS=false -DCONFIG_SELF_INIT=true -DCONFIG_LABEL_MEMORY=false  -c -o out/chacha.o chacha.c
error: invalid feature combination:  +avx10.1-256; will be promoted to avx10.1-512 [-Werror,-Winvalid-feature-combination]
1 error generated.
make: *** [Makefile:127: out/chacha.o] Error 1
Error: Process completed with exit code 2.

@rdevshp
ARM MTE: properly check the memory tag of small allocations for h_fre…
e8b1aa6 
…e/h_free_sized/h_free_aligned_sized during deallocation
@rdevshp

rdevshp commented Aug 2, 2026

Copy link
Copy Markdown
Contributor Author

hardened_malloc_free_tag_benchmark.tar.gz

I ran this benchmark on komodo, and the result I got was (free_check_tag uses __arm_mte_get_tag and free_check_tag_metadata uses metadata->arm_mte_tags for checking the tag)

variant,scenario,size,mean_median_ns_per_free
free_check_tag,free,8,73.056956
free_check_tag,free,56,74.063357
free_check_tag,free,248,94.561016
free_check_tag,free,1016,215.705831
free_check_tag,read_other_buffer,8,53.994704
free_check_tag,read_other_buffer,56,51.556661
free_check_tag,read_other_buffer,248,76.594489
free_check_tag,read_other_buffer,1016,220.489137
free_check_tag_metadata,free,8,73.032734
free_check_tag_metadata,free,56,74.783016
free_check_tag_metadata,free,248,95.965231
free_check_tag_metadata,free,1016,224.810621
free_check_tag_metadata,read_other_buffer,8,66.193438
free_check_tag_metadata,read_other_buffer,56,55.768227
free_check_tag_metadata,read_other_buffer,248,78.419081
free_check_tag_metadata,read_other_buffer,1016,222.878324

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@rdevshp @thestinger