casaroli commented on code in PR #21360:
URL: https://github.com/apache/nuttx/pull/21360#discussion_r4467819418
##########
mm/kasan/sw_tags.c:
##########
@@ -187,12 +187,27 @@ FAR void *kasan_unpoison(FAR const void *addr, size_t
size)
void kasan_register(FAR void *addr, FAR size_t *size)
{
FAR struct kasan_region_s *region;
+ uintptr_t start = (uintptr_t)addr;
Review Comment:
Run on qemu-armv8a:sw_tags at this head: 12 live heaps made from malloc()
blocks hit the `DEBUGASSERT(g_region_count < CONFIG_MM_KASAN_REGIONS)` at heap
7, so the check does not match a tagged `addr` and the region count is not
constant as the PR body says.
Fix: use `(uintptr_t)kasan_clear_tag(addr)` for `start`. With that and
#21358 the 12 heaps pass.
##########
mm/kasan/generic.c:
##########
@@ -238,12 +238,27 @@ bool kasan_bypass(bool state)
void kasan_register(FAR void *addr, FAR size_t *size)
{
FAR struct kasan_region_s *region;
+ uintptr_t start = (uintptr_t)addr;
+ uintptr_t end = start + *size;
irqstate_t flags;
+ size_t i;
+
+ for (i = 0; i < g_region_count; i++)
+ {
+ if (g_region[i] &&
+ start >= g_region[i]->begin &&
+ end <= g_region[i]->end)
+ {
+ /* Already registered */
+
+ return;
Review Comment:
Run on qemu-armv8a:nsh with generic KASAN: a heap made with
`mm_initialize()` inside a malloc() block, then `__asan_load4_noabort()` on its
never-allocated memory, on a chunk header and past a chunk. Master reports all
three, this PR reports none.
Fix: call `kasan_poison(addr, *size)` before this return, here and in
sw_tags.c. With that, all three are reported again and 12 live inner heaps
still do not hit the region limit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
