Maybe it could be more fair to compare against glibc malloc with all the mitigations patched out? It's only a 132 line patch to get rid of all the mitigations I know of (pointer mangling, double-free detection, tcache key checks and initialization, tcache chunk size checks, doubly-linked-list consistency checks, and everything else that is an if statement guarding a malloc_printerr or malloc_printerr_tail). Took about 5 minutes.
Maybe I'll take the time to benchmark this later.
I'd love to see your results. Relatedly the mimalloc-bench project can run many different work loads against many different allocators, and in particular it has a distinction between hardened allocators and unhardened. Would be really interesting to see your 5-minute patch to unharden glibc plugged into that suit of workloads!
Also, if you look at my beloved smalloc, I'd be really interested in if you have any ideas of how to harden it against widespread, realistic attacks without totally destroying its succinctness. I have one idea, but it probably won't work and I don't want to tell it to you until you've had a chance to think of your own. :-)
I'd love to see your results. Relatedly the mimalloc-bench project can run many different work loads against many different allocators, and in particular it has a distinction between hardened allocators and unhardened. Would be really interesting to see your 5-minute patch to unharden glibc plugged into that suit of workloads!
Also, if you look at my beloved smalloc, I'd be really interested in if you have any ideas of how to harden it against widespread, realistic attacks without totally destroying its succinctness. I have one idea, but it probably won't work and I don't want to tell it to you until you've had a chance to think of your own. :-)