-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Asan fix #1799
Asan fix #1799
Conversation
For "core: asan: tag access for .ARM.extab and .ARM.exidx": |
for "core: asan: fix check_access() ": |
59654e0
to
89c7db4
Compare
Tags applied |
I have test this patch with xtest, and it resolves the problem i mentioned in #1790 , but i got another problem, this is my error message:
It have applied the latest
@jenswi-linaro Only runs the gp_8060 can't reproduce the problem, i must run xtest all to produce this error, so i guess maybe some branch code of the calloc can't deal with asan very well. |
@prime-zeng I have mistakenly inserted an extra 'x' in the stack dump. Fixed in #1802. Thanks for reporting! |
I got a slightly different call stack when testing this PR on QEMU (
Hangs there, secure console shows a panic which decodes to:
|
A slightly different stack still in
|
Added two commits that should fix the problem reported. These two commits should be reordered first before merging this PR. |
For the 3 first For the last: |
@etienne-lms , bget() tags the requested amount of memory allocated, but eventual padding etc isn't tagged so writes there from instrumented functions (for instance the normal memset()) will be caught. |
Crystal clear, thanks. |
3f9995e
to
121e56f
Compare
Tags applied, commits reordered. |
By the way, would you mind adding your explanation
into the commit comment? |
121e56f
to
12fd77a
Compare
commit message amended. |
It looks like |
Provides asan_memset_unchecked() which does a memset that isn't checked against the tagging in the ASAN shadow area. If ASAN isn't enabled it's replaced by a direct call to memset(). Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
The malloc implementation uses the new asan_memset_unchecked() function internally instead of memset() to avoid unexpected asserts when the address sanitizer is enabled. bget() tags the requested amount of memory allocated, but eventual padding etc isn't tagged so writes there from instrumented functions, for instance the normal memset(), will be caught. Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Prior to this patch the for loop in check_access() that checks the access in the shadow area is skipping accesses smaller than a ASAN block (8 bytes). This patch fixes that problem and checks also smaller accesses. Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
The two sections .ARM.extab and .ARM.exidx are accessed when printing a stack trace. Tag access for these two sections to avoid recursive panics due to failing checks against shadow area. Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU) Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
12fd77a
to
5811b26
Compare
|
The remaining build failures are caused by 6a815af ("core: introduce TEE_RAM_VA_START and TEE_TEXT_VA_START"). So I'm merging this PR now. |
No description provided.