Skip to content

fix pointer aliasing in malloc dispatch tables in InitNativeAllocatorDispatch#70

Open
rdevshp wants to merge 1 commit into
GrapheneOS:16-qpr2from
rdevshp:alias_scudo_fix
Open

fix pointer aliasing in malloc dispatch tables in InitNativeAllocatorDispatch#70
rdevshp wants to merge 1 commit into
GrapheneOS:16-qpr2from
rdevshp:alias_scudo_fix

Conversation

@rdevshp
Copy link
Copy Markdown
Contributor

@rdevshp rdevshp commented May 12, 2026

The aliased malloc dispatch table can cause issues with malloc debug.

@thestinger
Copy link
Copy Markdown
Member

Please explain what this is addressing.

@rdevshp
Copy link
Copy Markdown
Contributor Author

rdevshp commented May 12, 2026

Inside MallocInitImpl, it first calls InitNativeAllocatorDispatch, which sets both globals->current_dispatch_table and globals->default_dispatch_table to the address of globals->malloc_dispatch_table.

Then it calls InstallHooks when MallocDebug is enabled, which then calls 1. LoadSharedLibrary and then 2. FinishInstallHooks.

LoadSharedLibrary loads the globals->malloc_dispatch_table with the malloc debug functions. Due to the aliasing, globals->current_dispatch_table and globals->default_dispatch_table are also set to the malloc debug functions.

Then in FinishInstallHooks, debug_initialize is called in the following code

  const MallocDispatch* prev_dispatch = GetDefaultDispatchTable();
  if (prev_dispatch == nullptr) {
    prev_dispatch = NativeAllocatorDispatch();
  }

  if (!init_func(prev_dispatch, &gZygoteChild, options)) {
    error_log("%s: failed to enable malloc %s", getprogname(), prefix);
    ClearGlobalFunctions();
    return false;
  }

This means that debug_initialize is not going to be able to properly save prev_dispatch due to the aliasing as it is already overridden by LoadSharedLibrary.

@thestinger
Copy link
Copy Markdown
Member

I don't understand why you're using atomic_store.

@rdevshp rdevshp force-pushed the alias_scudo_fix branch from abcb9ed to 3377512 Compare May 12, 2026 13:14
@rdevshp
Copy link
Copy Markdown
Contributor Author

rdevshp commented May 12, 2026

I have removed atomic_store.

@rdevshp
Copy link
Copy Markdown
Contributor Author

rdevshp commented May 13, 2026

Basically globals->malloc_dispatch_table is the dispatch table to store allocator hooks, not for storing the underlying allocator implementations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants