This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit c237f0b6e3fb6d65c0ff199ed39bb25d56a97b5a Author: buxiasen <[email protected]> AuthorDate: Mon Jan 19 17:51:41 2026 +0800 mm_heap: fix node->blink->flink possible hwtag not matched. If enable mte, the blink->flink maybe in different lifecycle. We should skip the kasan tag in debug assert. Signed-off-by: buxiasen <[email protected]> --- mm/mm_heap/mm_checkcorruption.c | 5 +++-- mm/mm_heap/mm_mallinfo.c | 7 +++++-- mm/mm_heap/mm_memdump.c | 7 +++++-- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/mm/mm_heap/mm_checkcorruption.c b/mm/mm_heap/mm_checkcorruption.c index 57570499020..8e7ea2a4e35 100644 --- a/mm/mm_heap/mm_checkcorruption.c +++ b/mm/mm_heap/mm_checkcorruption.c @@ -32,6 +32,7 @@ #include <nuttx/arch.h> #include <nuttx/mm/mm.h> #include <nuttx/irq.h> +#include <nuttx/mm/kasan.h> #include "mm_heap/mm.h" @@ -53,10 +54,10 @@ static void checkcorruption_handler(FAR struct mm_allocnode_s *node, FAR struct mm_freenode_s *fnode = (FAR void *)node; ASSERT(nodesize >= MM_MIN_CHUNK); - ASSERT(fnode->blink->flink == fnode); + ASSERT(kasan_clear_tag(fnode->blink->flink) == kasan_clear_tag(fnode)); ASSERT(MM_SIZEOF_NODE(fnode->blink) <= nodesize); ASSERT(fnode->flink == NULL || - fnode->flink->blink == fnode); + kasan_clear_tag(fnode->flink->blink) == kasan_clear_tag(fnode)); ASSERT(fnode->flink == NULL || MM_SIZEOF_NODE(fnode->flink) == 0 || MM_SIZEOF_NODE(fnode->flink) >= nodesize); diff --git a/mm/mm_heap/mm_mallinfo.c b/mm/mm_heap/mm_mallinfo.c index a040c66b479..cf2bfbbecdb 100644 --- a/mm/mm_heap/mm_mallinfo.c +++ b/mm/mm_heap/mm_mallinfo.c @@ -30,6 +30,7 @@ #include <nuttx/debug.h> #include <nuttx/mm/mm.h> +#include <nuttx/mm/kasan.h> #include "mm_heap/mm.h" @@ -69,10 +70,12 @@ static void mallinfo_handler(FAR struct mm_allocnode_s *node, FAR void *arg) FAR struct mm_freenode_s *fnode = (FAR void *)node; DEBUGASSERT(nodesize >= MM_MIN_CHUNK); - DEBUGASSERT(fnode->blink->flink == fnode); + DEBUGASSERT(kasan_clear_tag(fnode->blink->flink) == + kasan_clear_tag(fnode)); DEBUGASSERT(MM_SIZEOF_NODE(fnode->blink) <= nodesize); DEBUGASSERT(fnode->flink == NULL || - fnode->flink->blink == fnode); + kasan_clear_tag(fnode->flink->blink) == + kasan_clear_tag(fnode)); DEBUGASSERT(fnode->flink == NULL || MM_SIZEOF_NODE(fnode->flink) == 0 || MM_SIZEOF_NODE(fnode->flink) >= nodesize); diff --git a/mm/mm_heap/mm_memdump.c b/mm/mm_heap/mm_memdump.c index 45b349bca00..d514e710710 100644 --- a/mm/mm_heap/mm_memdump.c +++ b/mm/mm_heap/mm_memdump.c @@ -32,6 +32,7 @@ #include <execinfo.h> #include <nuttx/mm/mm.h> +#include <nuttx/mm/kasan.h> #include "mm_heap/mm.h" @@ -210,10 +211,12 @@ static void memdump_handler(FAR struct mm_allocnode_s *node, FAR void *arg) FAR struct mm_freenode_s *fnode = (FAR void *)node; DEBUGASSERT(nodesize >= MM_MIN_CHUNK); - DEBUGASSERT(fnode->blink->flink == fnode); + DEBUGASSERT(kasan_clear_tag(fnode->blink->flink) == + kasan_clear_tag(fnode)); DEBUGASSERT(MM_SIZEOF_NODE(fnode->blink) <= nodesize); DEBUGASSERT(fnode->flink == NULL || - fnode->flink->blink == fnode); + kasan_clear_tag(fnode->flink->blink) == + kasan_clear_tag(fnode)); DEBUGASSERT(fnode->flink == NULL || MM_SIZEOF_NODE(fnode->flink) == 0 || MM_SIZEOF_NODE(fnode->flink) >= nodesize);
