Skip to content
Permalink
Browse files
bmalloc: vm allocations should plant guard pages
https://bugs.webkit.org/show_bug.cgi?id=156937

Reviewed by Michael Saboff.

* bmalloc/Object.h:
(bmalloc::Object::operator-): Added a - helper.

* bmalloc/VMAllocate.h:
(bmalloc::vmRevokePermissions): Added a helper to revoke permissions on
a VM region. We use this for guard pages.

* bmalloc/VMHeap.cpp:
(bmalloc::VMHeap::allocateSmallChunk): Add guard pages to the start and
end of the chunk.

Note that we don't guard large chunks becuase we need to be able to merge
them. Otherwise, we will run out of virtual addresses.


Canonical link: https://commits.webkit.org/175048@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199936 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
geoffreygaren committed Apr 22, 2016
1 parent a8bde5f commit fdcb8a8b858def95fc852acdc88b9d909a006c65
Showing with 39 additions and 0 deletions.
  1. +21 −0 Source/bmalloc/ChangeLog
  2. +6 −0 Source/bmalloc/bmalloc/Object.h
  3. +6 −0 Source/bmalloc/bmalloc/VMAllocate.h
  4. +6 −0 Source/bmalloc/bmalloc/VMHeap.cpp
@@ -1,3 +1,24 @@
2016-04-22 Geoffrey Garen <ggaren@apple.com>

bmalloc: vm allocations should plant guard pages
https://bugs.webkit.org/show_bug.cgi?id=156937

Reviewed by Michael Saboff.

* bmalloc/Object.h:
(bmalloc::Object::operator-): Added a - helper.

* bmalloc/VMAllocate.h:
(bmalloc::vmRevokePermissions): Added a helper to revoke permissions on
a VM region. We use this for guard pages.

* bmalloc/VMHeap.cpp:
(bmalloc::VMHeap::allocateSmallChunk): Add guard pages to the start and
end of the chunk.

Note that we don't guard large chunks becuase we need to be able to merge
them. Otherwise, we will run out of virtual addresses.

2016-04-22 Geoffrey Garen <ggaren@apple.com>

bmalloc: Constify introspect function pointer table
@@ -52,6 +52,7 @@ class Object {
SmallPage* page();

Object operator+(size_t);
Object operator-(size_t);
bool operator<=(const Object&);

private:
@@ -64,6 +65,11 @@ inline Object Object::operator+(size_t offset)
return Object(m_chunk, m_offset + offset);
}

inline Object Object::operator-(size_t offset)
{
return Object(m_chunk, m_offset - offset);
}

inline bool Object::operator<=(const Object& other)
{
BASSERT(m_chunk == other.m_chunk);
@@ -137,6 +137,12 @@ inline void vmDeallocate(void* p, size_t vmSize)
munmap(p, vmSize);
}

inline void vmRevokePermissions(void* p, size_t vmSize)
{
vmValidate(p, vmSize);
mprotect(p, vmSize, PROT_NONE);
}

// Allocates vmSize bytes at a specified power-of-two alignment.
// Use this function to create maskable memory regions.

@@ -75,6 +75,12 @@ void VMHeap::allocateSmallChunk(std::lock_guard<StaticMutex>& lock, size_t pageC
Object begin(chunk, metadataSize);
Object end(chunk, chunkSize);

vmRevokePermissions(begin.begin(), pageSize);
vmRevokePermissions(end.begin() - pageSize, pageSize);

begin = begin + pageSize;
end = end - pageSize;

for (Object it = begin; it + pageSize <= end; it = it + pageSize) {
SmallPage* page = it.page();
new (page) SmallPage;

0 comments on commit fdcb8a8

Please sign in to comment.