nuttx/nuttx-mirror
1
2
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2025-01-13 09:49:21 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

mm/kasan: print memory around poisoned address

Browse source 
Print shadow memory following asan format.
==3118004==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5618ac32a100 at pc 0x5618ac32727f bp 0x7ffe5f3e66f0 sp 0x7ffe5f3e66e0
WRITE of size 4 at 0x5618ac32a100 thread T0

#0 0x5618ac32727e in main /home/baerg/vela/x4b/asan_test.c:12
#1 0x7f221ce29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#2 0x7f221ce29e3f in __libc_start_main_impl ../csu/libc-start.c:392
#3 0x5618ac327144 in _start (/home/baerg/vela/x4b/asan_test+0x1144)
0x5618ac32a100 is located 0 bytes to the right of global variable 'buffer' defined in 'asan_test.c:5:6' (0x5618ac32a0e0) of size 32
SUMMARY: AddressSanitizer: global-buffer-overflow /home/baerg/vela/x4b/asan_test.c:12 in main
Shadow bytes around the buggy address:
0x0ac39585d3d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d400: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9
0x0ac39585d410: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
=>0x0ac39585d420:[f9]f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ac39585d470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Signed-off-by: yinshengkai <yinshengkai@xiaomi.com>
This commit is contained in:
yinshengkai 2023-12-29 11:57:19 +08:00 committed by Xiang Xiao
parent 5a39e83c05
commit a9afed96b9
1 changed files with 52 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
mm/kasan/kasan.c
View file

@ -28,6 +28,7 @@
#include <debug.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include "kasan.h"
@ -74,6 +75,12 @@ struct kasan_region_s
uintptr_t shadow[1];
};
/****************************************************************************
* Private Function Prototypes
****************************************************************************/
static bool kasan_is_poisoned(FAR const void *addr, size_t size);
/****************************************************************************
* Private Data
****************************************************************************/
@ -136,6 +143,49 @@ static FAR uintptr_t *kasan_mem_to_shadow(FAR const void *ptr, size_t size,
return NULL;
}
static void kasan_show_memory(FAR const uint8_t *addr, size_t size,
size_t dumpsize)
{
FAR const uint8_t *start = (FAR const uint8_t *)
(((uintptr_t)addr) & ~0xf) - dumpsize;
FAR const uint8_t *end = start + 2 * dumpsize;
FAR const uint8_t *p = start;
char buffer[256];
_alert("Shadow bytes around the buggy address:\n");
for (p = start; p < end; p += 16)
{
int ret = sprintf(buffer, " %p: ", p);
int i;
for (i = 0; i < 16; i++)
{
if (kasan_is_poisoned(p + i, 1))
{
if (p + i == addr)
{
ret += sprintf(buffer + ret,
"\b[\033[31m%02x\033[0m ", p[i]);
}
else if (p + i == addr + size - 1)
{
ret += sprintf(buffer + ret, "\033[31m%02x\033[0m]", p[i]);
}
else
{
ret += sprintf(buffer + ret, "\033[31m%02x\033[0m ", p[i]);
}
}
else
{
ret += sprintf(buffer + ret, "\033[37m%02x\033[0m ", p[i]);
}
}
_alert("%s\n", buffer);
}
}
static void kasan_report(FAR const void *addr, size_t size,
bool is_write,
FAR void *return_address)
@ -148,6 +198,8 @@ static void kasan_report(FAR const void *addr, size_t size,
"size is %zu, return address: %p\n",
is_write ? "write" : "read",
addr, size, return_address);
kasan_show_memory(addr, size, 80);
PANIC();
}