My hardened malloc implementation now has the planned guard slabs feature:
github.com/AndroidHardeni
It's a cheap way of having many guard pages interspersed with small allocations. It skips possible slab locations so they never get unprotected. It just needs some fine tuning.
Conversation
Each skipped slab results in a wasted slab metadata. Slabs are page spans and metadata is currently 32 bytes (will become 56 or 64 bytes when the core implementation is finished) so it that's quite cheap. The desired outcome of leaving many guard pages does have a cost though.
1
Each guard slab results in having 2 extra VMAs in the Linux kernel which are several times larger than the slab metadata structs. It also makes the address space sparser which makes TLB caching less efficient. Frequency of guard slabs is yet another performance vs. security knob.
Replying to
The initial implementation leaves one after every slab which is likely too aggressive as a default. I'll probably adjust it to leaving a guard slab after every 9 slabs and then this can become one of the possible performance vs. security knobs (carefully) exposed as options.