On Wed, 6 Apr 2022 at 19:31, Sean Anderson seanga2@gmail.com wrote:
On 4/3/22 6:39 AM, Andrew Scull wrote:
I've been experimenting with ASAN on sandbox and turned up a few issues that are fixed in this series.
Basic ASAN was easy to turn on, but integrating with dlmalloc was messier and fairly intrusive. Even when I had it working, there was only a small redzone between allocations which limits the usefulness.
Do you have any patches for this?
They're becoming less of a mess as we speak, except the dlmalloc part which I don't have a good idea how to make neater. I'm actually doing it as a prerequisite for fuzzing, which I've almost got an acceptable feeling framework for and hope to be able to share fairly soon. But I could post just the ASAN parts separately if there's interest for that.
If you're using gcc, you can just add -fsanitize=address to the compiler and linker commands; clang requires some more work to rename symbols that begin with '.'.
--Sean
I saw another series on the list by Sean Anderson to enable valgrind which was finding a different set of issues, though there was one overlap that Sean is fixing with "[PATCH] IOMUX: Fix access past end of console_devices".
With these issues fixed, I was able to run the dm tests without any ASAN issues. There are a couple of leaks reported at the end, but that's for another day.
Andrew Scull (8): doc: Correct position of gdb '--args' parameter acpi: Fix buffer overflow in do_acpi_dump() x86: sandbox: Add missing PCI bar to barinfo usb: sandbox: Check for string end in copy_to_unicode() usb: sandbox: Bounds check read from buffer sound: Fix buffer overflow in square wave generation test: Fix pointer overrun in dm_test_devm_regmap() test: dm: devres: Remove use-after-free
cmd/acpi.c | 2 +- doc/develop/tests_sandbox.rst | 2 +- drivers/power/acpi_pmc/pmc_emul.c | 1 + drivers/sound/sound.c | 6 ++---- drivers/usb/emul/sandbox_flash.c | 2 ++ drivers/usb/emul/usb-emul-uclass.c | 5 ++--- test/dm/devres.c | 5 +---- test/dm/regmap.c | 9 ++++----- 8 files changed, 14 insertions(+), 18 deletions(-)