nuttx/nuttx-update
1
2
Fork 1
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

mm/heap: add coloration after free to detect use after free issue

Browse source 
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This commit is contained in:
dongjiuzhu1 2023-09-05 13:44:14 +08:00 committed by Alan Carvalho de Assis
parent a7d0b6c120
commit 36e3d32740
3 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
mm/mempool/mempool.c
View file

@ -273,6 +273,10 @@ retry:
}
}
#ifdef CONFIG_MM_FILL_ALLOCATIONS
memset(blk, 0xaa, pool->blocksize);
#endif
#if CONFIG_MM_BACKTRACE >= 0
mempool_add_backtrace(pool, (FAR struct mempool_backtrace_s *)
((FAR char *)blk + pool->blocksize));
@ -312,6 +316,10 @@ void mempool_free(FAR struct mempool_s *pool, FAR void *blk)
pool->nalloc--;
#endif
#ifdef CONFIG_MM_FILL_ALLOCATIONS
memset(blk, 0x55, pool->blocksize);
#endif
if (pool->interruptsize > blocksize)
{
if ((FAR char *)blk >= pool->ibase &&

4
mm/mm_heap/mm_free.c
View file

@ -104,6 +104,10 @@ void mm_free(FAR struct mm_heap_s *heap, FAR void *mem)
return;
}
#ifdef CONFIG_MM_FILL_ALLOCATIONS
memset(mem, 0x55, mm_malloc_size(heap, mem));
#endif
kasan_poison(mem, mm_malloc_size(heap, mem));
/* Map the memory chunk into a free node */

8
mm/tlsf/mm_tlsf.c
View file

@ -689,6 +689,10 @@ void mm_free(FAR struct mm_heap_s *heap, FAR void *mem)
if (mm_lock(heap) == 0)
{
#ifdef CONFIG_MM_FILL_ALLOCATIONS
memset(mem, 0x55, mm_malloc_size(heap, mem));
#endif
kasan_poison(mem, mm_malloc_size(heap, mem));
/* Pass, return to the tlsf pool */
@ -1064,6 +1068,10 @@ FAR void *mm_malloc(FAR struct mm_heap_s *heap, size_t size)
memdump_backtrace(heap, buf);
#endif
kasan_unpoison(ret, mm_malloc_size(heap, ret));
#ifdef CONFIG_MM_FILL_ALLOCATIONS
memset(ret, 0xaa, mm_malloc_size(heap, ret));
#endif
}
return ret;