casaroli commented on code in PR #21360:
URL: https://github.com/apache/nuttx/pull/21360#discussion_r4448851546
##########
mm/kasan/sw_tags.c:
##########
@@ -187,12 +187,27 @@ FAR void *kasan_unpoison(FAR const void *addr, size_t
size)
void kasan_register(FAR void *addr, FAR size_t *size)
{
FAR struct kasan_region_s *region;
+ uintptr_t start = (uintptr_t)addr;
Review Comment:
In SW_TAGS mode a heap made from a malloc() block has a tagged `addr`, so
`end <= g_region[i]->end` is never true and this check never matches.
Fix: use `(uintptr_t)kasan_clear_tag(addr)` for `start`.
##########
mm/kasan/generic.c:
##########
@@ -238,12 +238,27 @@ bool kasan_bypass(bool state)
void kasan_register(FAR void *addr, FAR size_t *size)
{
FAR struct kasan_region_s *region;
+ uintptr_t start = (uintptr_t)addr;
+ uintptr_t end = start + *size;
irqstate_t flags;
+ size_t i;
+
+ for (i = 0; i < g_region_count; i++)
+ {
+ if (g_region[i] &&
+ start >= g_region[i]->begin &&
+ end <= g_region[i]->end)
+ {
+ /* Already registered */
+
+ return;
Review Comment:
This return also skips `kasan_poison(addr, *size)`. A heap made inside a
block of another heap (for example `fs_heap_initialize()`) now starts
unpoisoned, so KASAN does not report an access to its free memory or to its
chunk headers.
Fix: call `kasan_poison(addr, *size)` before the return, here and in
sw_tags.c.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
