Skip to content

fix pointer aliasing in malloc dispatch tables in InitNativeAllocatorDispatch#74

Open
rdevshp wants to merge 1 commit into
GrapheneOS:17from
rdevshp:alias_scudo_fix
Open

fix pointer aliasing in malloc dispatch tables in InitNativeAllocatorDispatch#74
rdevshp wants to merge 1 commit into
GrapheneOS:17from
rdevshp:alias_scudo_fix

Conversation

@rdevshp

@rdevshp rdevshp commented Jun 27, 2026

Copy link
Copy Markdown

The aliased malloc dispatch table can cause issues with malloc debug.

(the following is pasted from #70 (comment) )

Inside MallocInitImpl, it first calls InitNativeAllocatorDispatch, which sets both globals->current_dispatch_table and globals->default_dispatch_table to the address of globals->malloc_dispatch_table.

Then it calls InstallHooks when MallocDebug is enabled, which then calls 1. LoadSharedLibrary and then 2. FinishInstallHooks.

LoadSharedLibrary loads the globals->malloc_dispatch_table with the malloc debug functions. Due to the aliasing, globals->current_dispatch_table and globals->default_dispatch_table are also set to the malloc debug functions.

Then in FinishInstallHooks, debug_initialize is called in the following code

  const MallocDispatch* prev_dispatch = GetDefaultDispatchTable();
  if (prev_dispatch == nullptr) {
    prev_dispatch = NativeAllocatorDispatch();
  }

  if (!init_func(prev_dispatch, &gZygoteChild, options)) {
    error_log("%s: failed to enable malloc %s", getprogname(), prefix);
    ClearGlobalFunctions();
    return false;
  }

This means that debug_initialize is not going to be able to properly save prev_dispatch due to the aliasing as it is already overridden by LoadSharedLibrary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant