Bug 298803
| Summary: | [libpas] Implement primary support for MTE | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Marcus Plutowski <marcus_plutowski> |
| Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> |
| Status: | REOPENED | ||
| Severity: | Normal | CC: | commit-queue, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | 299465 | ||
| Bug Blocks: | |||
Marcus Plutowski
rdar://160499929
As announced on September 9th, the SoCs used in the next generation of iPhones will include support for ARM'S Memory Tagging Extension functionality. As part of Apple's MIE (Memory Integrity Enforcement) feature, libpas should implement support for MTE and related memory-safety functionality to ensure that WebKit is up to par with the new memory safety standards set by the rest of the system.
To do so, libpas should, when possible, allocate pages with backing MTE memory and, prior to returning allocations to the caller, tag them so that only valid pointers can access them (up to the standard probabilistic bound), as well as doing the necessary work to clean up tags and pre-empt certain attacker strategies with standard hardening measures.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Marcus Plutowski
Pull request: https://github.com/WebKit/WebKit/pull/50687
EWS
Committed 300469@main (d3acbe4f9624): <https://commits.webkit.org/300469@main>
Reviewed commits have been landed. Closing PR #50687 and removing active labels.
WebKit Commit Bot
Re-opened since this is blocked by bug 299465
Marcus Plutowski
<rdar://problem/161273712>
Marcus Plutowski
Pull request: https://github.com/WebKit/WebKit/pull/51283