When initializing a memory block, the shadow area record of the first
memory block is used first.When uninitializing, unpoison is required, otherwise the memory will be marked incorrectly.
The following case will cause problems:
void *mem = malloc(1024);
struct mm_heap_s *a = mm_initialize("hello", mem, 1024);
int *b = mm_malloc(a, sizeof(int *));
*b = 100;
printf("Hello, World!! %d\n", *b);
mm_free(a, b);
mm_uninitialize(a);
free(mem);
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Add hw_tags.c, which will call arm64_mte to implement tagging of memory blocks by operating registers
2. It has been able to run normally on the default NX memory allocator, excluding mempool and tlsf
3. On more complex configurations, memory tests such as memstress can run normally without system crashes
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
When the size of the new realloc is larger than the old one and can be expanded forward and backward, the tag of oldmem needs to be set to the same as newmem, otherwise memcpy will report a kasan error.
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Tested on QEMU, the two sockets were basically the same, and their performance was not affected. The size of the generated bin file was also the same
2. Extract global detection as a separate file, both types of Kasan support global variable out of bounds detection simultaneously
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Modify the Kasan global variable script to support array storage of region addresses
2. Due to the lack of formatting in the previous attempt, a formatting script was created
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. Use always_inline_function instead of inline, inline does not take effect
2. Activate Kasan acceleration by 1/7
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
1. The shadow area of global variables is different from heap
2. This modification has little impact on performance under O3 optimization
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
The following situations cannot be detected by Kasan:
On a 32-bit machine, only 12 bytes were poisoned, but 13 bytes were accessed. Due to the lack of upward alignment, only 3 bits were detected
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
When size is less than or equal to KASAN_SHADOW_SCALE, no check will be performed
We need to check whether the memory is accessible based on bit
Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
