When CONFIG_MM_KASAN_GLOBAL is enabled, hook.c is also linked into
libmm.a. However, g_global_region (defined in global.c) is only
injected into the nuttx ELF by kasan_global.py — it does not process
the app binary. This causes undefined symbol errors when linking an
app against libmm.a.
Guard the inclusion of global.c with __KERNEL__ so that only kernel
builds pull in the global KASAN region, while app builds fall back
to the no-op stub.
Signed-off-by: leisiji <2265215145@qq.com>
In SPLIT build mode, nuttx_add_kernel_library(mm SPLIT) creates two
targets: mm (system library) and kmm (kernel library). The compile
options were being applied to the mm target via
target_compile_options(mm ...), but the kasan instrumentation is
compiled as part of the kmm target.
Change target_compile_options(mm ...) to target_compile_options(kmm
...) so that FLAGS (including -fno-builtin and NO_LTO) are correctly
applied to the kernel target where kasan code is compiled.
Signed-off-by: leisiji <2265215145@qq.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Stop the report handler from re-entering KASAN by halting checks when printing.
Reuse the dump_only flag so read/write panic toggles only emit stack traces.
Retain stack dumps for panic-disabled paths without risking another overflow.
Signed-off-by: anpeiyun <anpeiyun@xiaomi.com>
When initializing a memory block, the shadow area record of the first
memory block is used first.When uninitializing, unpoison is required, otherwise the memory will be marked incorrectly.
The following case will cause problems:
void *mem = malloc(1024);
struct mm_heap_s *a = mm_initialize("hello", mem, 1024);
int *b = mm_malloc(a, sizeof(int *));
*b = 100;
printf("Hello, World!! %d\n", *b);
mm_free(a, b);
mm_uninitialize(a);
free(mem);
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
This can avoid crashes caused by uninitialized accesses to initialized variables in non-chip memory.
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Add hw_tags.c, which will call arm64_mte to implement tagging of memory blocks by operating registers
2. It has been able to run normally on the default NX memory allocator, excluding mempool and tlsf
3. On more complex configurations, memory tests such as memstress can run normally without system crashes
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
When the size of the new realloc is larger than the old one and can be expanded forward and backward, the tag of oldmem needs to be set to the same as newmem, otherwise memcpy will report a kasan error.
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
Renaming "modlib" to "libelf" is more in line with the implementation content,
which makes it easier for individual developers to understand the capabilities of this module.
CONFIG_LIBC_MODLIB -> CONFIG_LIBC_ELF
Signed-off-by: chao an <anchao.archer@bytedance.com>
It will be used to distinguish between hardware KASan and software KASan. Hardware KASan does not need to use plug-in
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
Of course, there is an error here, that is, the conditional judgment of
ifeq ($(CONFIG_LTO_NONE),n)
CFLAGS += -fno-lto
endif
is wrong, it should be judged as "ifneq ($(CONFIG_LTO_NONE),)"
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. When dynamically loading, the read-only data of arm64 architecture is accessed through PC offset. When opening the tag kasan, because the PC value does not have a tag, accessing the read-only data will be detected with a tag mismatch error.
2. uninitial heap use 0xff poison, initial heap use 1-254 unpoison.
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Similar to asan, supports single byte out of bounds detection
2. Fix the script to address the issue of not supporting the big end
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Tested on QEMU, the two sockets were basically the same, and their performance was not affected. The size of the generated bin file was also the same
2. Extract global detection as a separate file, both types of Kasan support global variable out of bounds detection simultaneously
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Modify the Kasan global variable script to support array storage of region addresses
2. Due to the lack of formatting in the previous attempt, a formatting script was created
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Use always_inline_function instead of inline, inline does not take effect
2. Activate Kasan acceleration by 1/7
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. The shadow area of global variables is different from heap
2. This modification has little impact on performance under O3 optimization
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
The following situations cannot be detected by Kasan:
On a 32-bit machine, only 12 bytes were poisoned, but 13 bytes were accessed. Due to the lack of upward alignment, only 3 bits were detected
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
PANIC never returns and abort is called to exit the process after calling assert
When BOARD_RESET_ON_ASSERT < 2, the second kasan_report will not be executed.
Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
When size is less than or equal to KASAN_SHADOW_SCALE, no check will be performed
We need to check whether the memory is accessible based on bit
Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
In function kasan_set_poison:
{
...
while (size--)
{
p[size] = value;
}
}
This will optimize to 'memset' function when compile option > O2.
But the memset must be instrument by kasan, so there is recursive
Signed-off-by: ligd <liguiding1@xiaomi.com>
