W-M-R opened a new pull request, #21358:
URL: https://github.com/apache/nuttx/pull/21358
## Summary
- `mm/mm_heap/mm_initialize.c`: align the computed region size down, so the
region passed to `kasan_register()` always satisfies the shadow mapping
alignment requirement.
- `mm/mm_heap/mm_heapmember.c`: clear the address tag before comparing
against
`mm_heapstart[]`/`mm_heapend[]`; with `CONFIG_MM_KASAN_SW_TAGS` the stored
addresses carry a tag and the comparison always failed.
- `mm/kasan/generic.c`, `mm/kasan/sw_tags.c`: `kasan_mem_to_shadow()` must
tolerate a NULL slot in `g_region[]` instead of dereferencing it.
- `mm/kasan/sw_tags.c`: replace the `rand()` based tag generator with a small
LCG. `rand()` needs the per-task seed in TLS, which does not exist yet
during early boot, so the first tagged allocation crashed.
## Impact
- Fixes false `-EFAULT`/`-EINVAL` on tagged KASAN configurations and a boot
crash with `CONFIG_MM_KASAN_SW_TAGS`.
- Untagged builds are unaffected.
## Testing
Host: Ubuntu 22.04, qemu-system-aarch64 8.2, aarch64-none-elf-gcc 13.
./tools/configure.sh -l qemu-armv8a:sw_tags
make -j
qemu-system-aarch64 -cpu cortex-a53 -nographic \
-machine virt,virtualization=on,gic-version=3 \
-chardev stdio,id=con,mux=on -serial chardev:con \
-mon chardev=con,mode=readline -kernel ./nuttx
nsh> kasantest
Before: boot dies in the first tagged allocation (`rand()` TLS is NULL);
`mm_heapmember()` rejects valid heap pointers and `kasantest` fails.
After: the board boots to NSH and `kasantest` passes. Also built
`qemu-armv8a:nsh` (untagged) to confirm no regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
