Strip ARM64 TBI tag byte from addresses before pread on /proc/<pid>/mem#124709
Open
steveisok wants to merge 2 commits intodotnet:mainfrom
Open
Strip ARM64 TBI tag byte from addresses before pread on /proc/<pid>/mem#124709steveisok wants to merge 2 commits intodotnet:mainfrom
steveisok wants to merge 2 commits intodotnet:mainfrom
Conversation
Android's scudo heap allocator uses ARM64 Top-Byte Ignore (TBI) to tag heap pointers with a non-zero top byte (e.g., 0xB4). While the CPU ignores this byte during memory access, pread on /proc/<pid>/mem treats the offset as a file position where TBI does not apply, causing EINVAL. Strip the top byte before pread in PAL_ReadProcessMemory and createdump's ReadProcessMemory. This is a no-op on non-Android ARM64 Linux today, but guards against future TBI/MTE adoption on other distributions. See https://www.kernel.org/doc/html/latest/arch/arm64/tagged-address-abi.html
Contributor
|
Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request addresses an issue with Android's scudo heap allocator, which uses ARM64 Top-Byte Ignore (TBI) to tag heap pointers. When reading process memory via pread on /proc/<pid>/mem, the kernel treats the offset as a file position rather than a virtual address, causing EINVAL errors for TBI-tagged pointers. The fix strips the top byte from addresses before calling pread.
Changes:
- Added TBI tag byte stripping in
PAL_ReadProcessMemoryfor non-Apple platforms - Added TBI tag byte stripping in createdump's
ReadProcessMemorybefore pread calls - Comprehensive comments explaining the Android scudo allocator issue and future-proofing for ARM MTE
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/coreclr/pal/src/debug/debug.cpp | Strips TBI tag byte from addresses before pread in PAL_ReadProcessMemory for non-Apple platforms |
| src/coreclr/debug/createdump/crashinfounix.cpp | Strips TBI tag byte from addresses before pread in crash dump memory reading, guarded by TARGET_ARM64 |
This was referenced Feb 22, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Android's scudo heap allocator uses ARM64 Top-Byte Ignore (TBI) to tag heap pointers with a non-zero top byte (e.g., 0xB4). While the CPU ignores this byte during memory access, pread on /proc//mem treats the offset as a file position where TBI does not apply, causing EINVAL.
Strip the top byte before pread in PAL_ReadProcessMemory and createdump's ReadProcessMemory. This is a no-op on non-Android ARM64 Linux today, but guards against future TBI/MTE adoption on other distributions.
See https://www.kernel.org/doc/html/latest/arch/arm64/tagged-address-abi.html