1446046 - Prevent pages from being recycled across arenas

Status: NEW

(Core :: Memory Allocator, enhancement, P3)

Description

[Tom Ritter [:tjr]]

Bug 1402174 provided a way to allocate into different arenas. A concern is that an attacker can trigger an entire page's worth of data to be de-allocated, and eventually reused between partitions. This would allow bypassing the partition protection.

Comment 1

[Mike Hommey [:glandium]]

There is no useful data in a chunk by the time it's been recycled. The only risk would be in the face of UAF, is it what this is meant to guard against?

Comment 2

[Tom Ritter [:tjr]]

(In reply to Mike Hommey [:glandium] from comment #1)
> There is no useful data in a chunk by the time it's been recycled. The only
> risk would be in the face of UAF, is it what this is meant to guard against?

Yea; one of the main goals of partitioning is to make exploiting UAFs more difficult; so reusing chunks between partitions would bring that back to the table.