Achierius
bmalloc/libpas hardening contributor
Summary
Works almost entirely in WebKit's allocator stack — libpas and bmalloc — with the recurring theme being MTE enablement: per-heap tagging policy, a tagged_bmalloc_heap, previous-tag-exclusion, MTE hard-mode re-enablement, and disabling TZone under MTE. Adjacent work touches JIT Cage relaxation, guard pages on the compact-heap reservation, and ParkingLot spinloop internals, so the footprint spans allocator hardening primitives rather than feature code. The security fixes cluster in the same place the feature work does — an OOB path in MAR code and a race in `pas_segregated_heap_medium_size_directory_for_index` — which makes newly-tagged heap paths and the MTE policy rework a reasonable sweep target for variant analysis.
Components
Security Fix History
Hardening Commits
- 2026-04-07 [libpas] Implement MTE Previous-Tag-Exclusion
- 2026-03-24 [bmalloc] Disable TZone allocations when MTE is enabled
- 2026-03-17 [libpas] Cleanup FastMalloc tagging in non-hardened WCP
- 2026-01-28 [bmalloc] Fix OpenSource MTE builds
- 2026-01-26 [libpas] Disable MTE for ASAN builds
- 2026-01-11 [libpas] Add stat counter for MTE tag writes
- 2025-12-01 Unreviewed ASAN build fix for retag-on-scavenge
- 2025-11-19 [libpas] Enable MTE for macOS
- 2025-11-04 [libpas] Fix guard for BENABLE use in pas_mte_config.h
Recent Commits
- 2026-08-07 [libpas] Inline PAS_MTE_HANDLEs which resolve to PAS_MTE_CLEAR*
- 2026-08-06 Implement JIT Cage Relaxation
- 2026-07-17 [libpas] Rework per-heap tagging policy logic
- 2026-07-01 Unreviewed, reverting 315921@main (6db83a42f97a)
- 2026-07-01 [libpas] Fix OoBable code-paths in MAR code ·
- 2026-07-01 [libpas] Fix race in pas_segregated_heap_medium_size_directory_for_index ·
- 2026-06-30 Re-enable MTE hard-mode
- 2026-06-26 [libpas] Rework per-heap tagging policy logic
- 2026-06-24 [libpas] Split pas_deallocate into inline-only and casual variants
- 2026-06-17 Change WTF, libpas exception codes to 0xbb08
- 2026-06-16 [libpas] Increase xctest timeout to 60m
- 2026-06-11 [libpas] Create new tagged_bmalloc_heap
- 2026-06-10 [libpas] Wrap test_pas with xctest harness
- 2026-06-06 [libpas] Build fix after 313922@main
- 2026-05-29 Scale down structure-heap reservation size with physical memory