Replace the alignment decided junk-and-stash with dealloc events
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 11.2k
- Forks
- 1.6k
- Avg merge
- 4d 8h
- Merged PRs (30d)
- 13
Description
Currently in order to sample for use-after-frees, special aligned pointers go through the junk-and-stash: https://github.com/jemalloc/jemalloc/blob/e8f9f13811c16acb1ab8771fd2ffe4437e1b8620/include/jemalloc/internal/jemalloc_internal_inlines_c.h#L434
However we have the thread_event which supports bytes-triggered events on dealloc as well. Implementing it that way has the benefits of:
- not limiting the alignment requirement to be at least page
- it becomes a completely runtime option, i.e. removing
config_uaf_detection.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the aligned-pointer handling in include/jemalloc/internal/jemalloc_internal_inlines_c.h around line 434, then trace the existing thread_event deallocation path. Verify how bytes-triggered dealloc events and config_uaf_detection currently interact. Done means use-after-free sampling no longer relies on junk-and-stash, supports alignments below page size, and is fully runtime-configurable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100