Open Bug 1523268 (PHC) Opened 7 years ago Updated 1 month ago

[meta] PHC (Probabilistic Heap Checker): a port of Chromium's GWP-ASan project to Firefox

Categories

(Core :: Memory Allocator, enhancement, P2)

Product:
Core
Component:
Memory Allocator
Type:
enhancement

Tracking

()

People

(Reporter: decoder, Assigned: decoder)

References

(Depends on 3 open bugs,
URL
)

Details

(Keywords: meta, sec-want)

The GWP-ASan project is a debug tool written by Google for Chrome. It’s purpose is to detect certain types of memory errors (including use-after-free). Unlike regular AddressSanitizer (ASan), the GWP-ASan project does this in a more lightweight and sampled way, meaning that each allocation is only checked with a certain probability.

The overall goal of our project is to port gwp-asan to Firefox including crash reporter support and deploy it to various channels, depending on how performance works out.

Depends on: 1523276
Depends on: 1523278
Priority: -- → P3
Depends on: 1567065
Alias: gwp-asan → PHC
Summary: [meta] Port the GWP-ASan project to Firefox → [meta] PHC (Probabilistic Heap Checker): a port of Chromium's GWP-ASan project to Firefox
Depends on: 1569862
Depends on: 1569864
Depends on: 1570612
Depends on: 1574388
Depends on: 1574390
Depends on: 1428235
Depends on: 1576515
No longer depends on: 1569862
No longer depends on: 1574388
No longer depends on: 1523276

Is this bug also going to be used to track crashes found with PHC, or is there a separate meta for that?

It is currently being used to track crashes, but if someone wanted to create a separate bug for that I wouldn't object.

Depends on: 1582251
Depends on: 1604335
Depends on: 1605341
Depends on: 1605343
Depends on: 1614875
Depends on: 1614967
No longer depends on: 1614967
Depends on: 1614967
Depends on: 1618158
Depends on: 1633112
Depends on: 1679430
Depends on: 1683035

Notes from discussion:

  • It might be handy to have some way to mark certain allocations as having a higher probability of being covered by PHC, but this may need significant code work.
  • It may be useful to apply PHC selectively to some processes (especially wrt Fission), but then make the "backlog" of not-freed-to-the-os allocations much larger to increase the probability of finding UAF.
Severity: major → S4
Priority: P3 → P2
status-firefox66: affected → ---
Component: General → Memory Allocator
Product: Firefox → Core
Depends on: 1712084
Depends on: 1631981
Depends on: 1741905
Depends on: 1789808
Depends on: 1800278
Depends on: 1800531
Depends on: 1800010
Depends on: PHC2023
Depends on: 1868372
Depends on: 1871216
Depends on: 1871573
Depends on: 1873592
Depends on: 1873597
Depends on: 1877048
Depends on: 1882438
Depends on: 1882962
Depends on: 1884064
Depends on: 1888333
Depends on: 1906578
Depends on: 1942551
Depends on: 1975906
Depends on: 1954381
You need to log in before you can comment on or make changes to this bug.