[components][asan] Add runtime AddressSanitizer for heap - #11772
[components][asan] Add runtime AddressSanitizer for heap#11772Zepp-Hanzj wants to merge 7 commits into
Conversation
Add a heap-only AddressSanitizer (kernel-address) runtime for RT-Thread. It instruments memory accesses via GCC's -fsanitize=kernel-address and detects heap-buffer-overflow and use-after-free at runtime, with a FinSH 'asan_info' command for interactive diagnosis. ## What - components/asan/: shadow memory + instrumented-access checks + report - allocator hooks to poison/unpoison heap blocks (malloc/free/realloc) - components/Kconfig: register RT_USING_ASAN with shadow/track/backtrace opts - src/SConscript: build mem/memheap/slab allocators without instrumentation - tools/building.py: inject -fsanitize=kernel-address on GCC ## Why RT-Thread lacks runtime memory-safety checking on MCU targets (ASan only existed on the x86 simulator). Heap overflow and use-after-free are the most common embedded memory bugs; this gives on-target detection with thread and block context in the report. ## Heap algorithm support - small mem: full support (overflow + use-after-free) - slab / memheap: overflow only (their allocators reuse freed blocks for metadata written via instrumented rt_memset, so free-block poisoning is disabled to avoid false positives) - userheap: mutually exclusive (Kconfig) Verified on qemu-vexpress-a9 (small mem / slab / memheap) and on a real STM32F407ZGT6 board.
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
🏷️ Tag: kernelReviewers: @GorrayLi @ReviewSun @hamburger-os @lianux-mm @wdfk-prog @xu18838022837 Changed Files (Click to expand)
🏷️ Tag: workflowReviewers: @Rbb666 @kurisaW @supperthomas Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-09-03 11:06 CST)
📝 Review Instructions
|
|
|
这部分以什么方式加入？直接加也并不合适，不应该把它做为一个独立的组件放到 components 目录下，可以考虑的方式是 |
感谢反馈，我理解后觉得放 关于「软件包方式」，有一点技术约束想说明：ASan 依赖 GCC 的 |
|
感谢PR，看到了描述中支持了ARM和RV，作者能否添加下代表性的BSP（qemu-a9）进行编译看护，并添加utest使用utest-auto-run ci看护起来? |
好的，我处理一下 |
Add rt_asan_report_count_get() to let the utest harness verify that a deliberate violation is actually detected (ASan uses the GCC _noabort variant, so a hit only prints and does not abort). Also move the use-after-free capability flag into asan.h as RT_ASAN_HAS_UAF_DETECTION so both the runtime and tests share a single source of truth.
rt_memcpy/rt_memset/rt_memmove copy word-at-a-time and may legally touch a few bytes past the requested count (word-aligned bulk loops). Under -fsanitize=kernel-address those accesses fall into poisoned heap redzones and raise false positives (notably during rt_realloc block migration). Mark them no_sanitize_address, mirroring how KASAN treats the same helpers.
Add a utest testcase (components.asan_tc) that exercises the ASan heap detection on a real target, plus a CI config that both compiles and runs it on qemu-vexpress-a9 via utest_auto_run. Test scenarios: - heap-buffer-overflow write / read - in-bounds access (no false positive) - realloc overflow - use-after-free read / write (small mem only)
|
感谢建议，已补充 utest 测试用例和 CI 看护。 新增测试用例（
CI 看护：
过程中发现并修复的一个问题： 已在 qemu-vexpress-a9 上本地验证：6 个测试单元全部 PASSED。 |
3 participants
Description / 描述
Add a heap-only runtime AddressSanitizer (kernel-address) for RT-Thread. It instruments memory accesses via GCC's
-fsanitize=kernel-addressand detects heap-buffer-overflow and use-after-free at runtime, with a FinSHasan_infocommand for interactive diagnosis.为 RT-Thread 新增仅针对堆的运行时 AddressSanitizer（kernel-address）。通过 GCC 的
-fsanitize=kernel-address对内存访问插桩，在运行时检测 堆缓冲区越界（heap-buffer-overflow） 和 释放后使用（use-after-free），并提供 FinSHasan_info命令进行交互式诊断。Why / 为什么需要
RT-Thread 在 MCU 目标上缺乏运行时内存安全检查（ASan 之前仅存在于 x86 模拟器）。堆越界与 use-after-free 是最常见的嵌入式内存 bug，本组件提供目标机上的运行时检测，且报告包含触发线程名与内存块归属信息。
What / 修改了哪些文件
components/asan/Kconfig：注册RT_USING_ASAN（含 shadow 大小 / track 表大小 / backtrace 开关）components/asan/SConscript：runtime 自身以-fno-sanitize=kernel-address编译避免递归components/asan/asan.c：shadow memory + 插桩访问检查 + 报告 + malloc/free/realloc hookcomponents/Kconfig：rsource "asan/Kconfig"src/SConscript：将 mem/memheap/slab 分配器移入非插桩编译组tools/building.py：GCC 下注入-fsanitize=kernel-addressHeap algorithm support / 堆算法支持
RT_USING_SMALL_MEM_AS_HEAP)RT_USING_SLAB_AS_HEAP)RT_USING_MEMHEAP_AS_HEAP)RT_USING_USERHEAP)Verification / 验证
asan_test_overflow（overflow by 2 bytes）、asan_test_uaf（USE-AFTER-FREE, offset +0）、asan_info全部命中kernel-address