mirror of
https://github.com/apache/nuttx.git
synced 2026-03-24 07:35:07 +08:00
kasan: Potential recursive registration shadow area error
When initializing a memory block, the shadow area record of the first
memory block is used first.When uninitializing, unpoison is required, otherwise the memory will be marked incorrectly.
The following case will cause problems:
void *mem = malloc(1024);
struct mm_heap_s *a = mm_initialize("hello", mem, 1024);
int *b = mm_malloc(a, sizeof(int *));
*b = 100;
printf("Hello, World!! %d\n", *b);
mm_free(a, b);
mm_uninitialize(a);
free(mem);
Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
This commit is contained in:
committed by
Alan C. Assis
parent
e57d2a5247
commit
aead1981a7
@@ -268,10 +268,13 @@ void kasan_unregister(FAR void *addr)
|
||||
{
|
||||
if (g_region[i]->begin == (uintptr_t)addr)
|
||||
{
|
||||
size_t size = g_region[i]->end - g_region[i]->begin;
|
||||
g_region_count--;
|
||||
memmove(&g_region[i], &g_region[i + 1],
|
||||
(g_region_count - i) * sizeof(g_region[0]));
|
||||
break;
|
||||
spin_unlock_irqrestore(&g_lock, flags);
|
||||
kasan_unpoison(addr, size);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -217,10 +217,13 @@ void kasan_unregister(FAR void *addr)
|
||||
{
|
||||
if (g_region[i]->begin == (uintptr_t)addr)
|
||||
{
|
||||
size_t size = g_region[i]->end - g_region[i]->begin;
|
||||
g_region_count--;
|
||||
memmove(&g_region[i], &g_region[i + 1],
|
||||
(g_region_count - i) * sizeof(g_region[0]));
|
||||
break;
|
||||
spin_unlock_irqrestore(&g_lock, flags);
|
||||
kasan_unpoison(addr, size);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user