• Ulan Degenbaev's avatar
    [heap] Rework ASLR for base::Platform::VirtualMemory · 0640cbf3
    Ulan Degenbaev authored
    Currently every VirtualMemory allocation on 64-bit systems
    uses a random 46-bit address hint for ASLR.
    
    This leads to wired page leak on MacOS discovered by Erik Chen (see
    crbug.com/700928 and https://chromium-review.googlesource.com/c/557958/):
    "The Darwin kernel [as of macOS 10.12.5] does not clean up page directory
    entries [PDE] created from mmap or mach_vm_allocate, even after
    the region is destroyed. Using a virtual address space that is too large
    causes a leak of about 1 wired [can never be paged out] page per call to
    mmap(). The page is only reclaimed when the process is killed."
    
    This patch changes VirtualMemory to accept the hint parameter explicitly.
    
    On MacOS the hints are confined to 4GB contiguous region. Algorithm:
    - On startup, set heap.mmap_region_base_ to a random address.
    - For each mmap use heap.mmap_region_base_ + (random_offset % (4*GB)).
    
    BUG=chromium:700928
    
    Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
    Change-Id: I2ae6a024e02fbe63f940105d7920b57c19abacc6
    Reviewed-on: https://chromium-review.googlesource.com/558876
    Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
    Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#46656}
    0640cbf3
Name
Last commit
Last update
benchmarks Loading commit data...
build_overrides Loading commit data...
docs Loading commit data...
gni Loading commit data...
gypfiles Loading commit data...
include Loading commit data...
infra Loading commit data...
samples Loading commit data...
src Loading commit data...
test Loading commit data...
testing Loading commit data...
third_party Loading commit data...
tools Loading commit data...
.clang-format Loading commit data...
.gitignore Loading commit data...
.gn Loading commit data...
.ycm_extra_conf.py Loading commit data...
AUTHORS Loading commit data...
BUILD.gn Loading commit data...
CODE_OF_CONDUCT.md Loading commit data...
ChangeLog Loading commit data...
DEPS Loading commit data...
LICENSE Loading commit data...
LICENSE.fdlibm Loading commit data...
LICENSE.strongtalk Loading commit data...
LICENSE.v8 Loading commit data...
LICENSE.valgrind Loading commit data...
Makefile Loading commit data...
Makefile.android Loading commit data...
OWNERS Loading commit data...
PRESUBMIT.py Loading commit data...
README.md Loading commit data...
WATCHLISTS Loading commit data...
codereview.settings Loading commit data...
snapshot_toolchain.gni Loading commit data...