Invalid use of madvise

[LemonBoy]

In tlsCsprngFill:

    switch (wipe_me.init_state) {
        .uninitialized => {
            if (want_fork_safety) {
                if (maybe_have_wipe_on_fork) {
                    if (std.os.madvise(
                        @ptrCast([*]align(mem.page_size) u8, &wipe_me),
                        @sizeOf(@TypeOf(wipe_me)),
                        std.os.MADV_WIPEONFORK,
                    )) 

Where @sizeOf(@TypeOf(wipe_me)) is 0x40 here.

But madvise doesn't give a damn about your 0x40 bytes, as you can see it will happily round it to something much bigger than 0x40.

The end result is that MADV_WIPEONFORK ends up wiping much more than wipe_me, every time you spawn a fresh thread or a child process you're actually zeroing a random page somewhere in memory.

[andrewrk]

Argh, the man pages are completely misleading on this. I looked at them carefully and concluded the opposite behavior. My fault for not looking at the kernel source.

[xackus]

I thought this was probably the case, but forgot to write about it.
Praise @LemonBoy, Devourer of Bugs 🐈!