[components][asan] Add runtime AddressSanitizer for heap - #11772
[components][asan] Add runtime AddressSanitizer for heap#11772Zepp-Hanzj wants to merge 4 commits into
Conversation
Add a heap-only AddressSanitizer (kernel-address) runtime for RT-Thread. It instruments memory accesses via GCC's -fsanitize=kernel-address and detects heap-buffer-overflow and use-after-free at runtime, with a FinSH 'asan_info' command for interactive diagnosis. ## What - components/asan/: shadow memory + instrumented-access checks + report - allocator hooks to poison/unpoison heap blocks (malloc/free/realloc) - components/Kconfig: register RT_USING_ASAN with shadow/track/backtrace opts - src/SConscript: build mem/memheap/slab allocators without instrumentation - tools/building.py: inject -fsanitize=kernel-address on GCC ## Why RT-Thread lacks runtime memory-safety checking on MCU targets (ASan only existed on the x86 simulator). Heap overflow and use-after-free are the most common embedded memory bugs; this gives on-target detection with thread and block context in the report. ## Heap algorithm support - small mem: full support (overflow + use-after-free) - slab / memheap: overflow only (their allocators reuse freed blocks for metadata written via instrumented rt_memset, so free-block poisoning is disabled to avoid false positives) - userheap: mutually exclusive (Kconfig) Verified on qemu-vexpress-a9 (small mem / slab / memheap) and on a real STM32F407ZGT6 board.
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
🏷️ Tag: kernelReviewers: @GorrayLi @ReviewSun @hamburger-os @lianux-mm @wdfk-prog @xu18838022837 Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-08-31 10:34 CST)
📝 Review Instructions
|
|
|
这部分以什么方式加入？直接加也并不合适，不应该把它做为一个独立的组件放到 components 目录下，可以考虑的方式是 |
感谢反馈，我理解后觉得放 关于「软件包方式」，有一点技术约束想说明：ASan 依赖 GCC 的 |
2 participants
Description / 描述
Add a heap-only runtime AddressSanitizer (kernel-address) for RT-Thread. It instruments memory accesses via GCC's
-fsanitize=kernel-addressand detects heap-buffer-overflow and use-after-free at runtime, with a FinSHasan_infocommand for interactive diagnosis.为 RT-Thread 新增仅针对堆的运行时 AddressSanitizer（kernel-address）。通过 GCC 的
-fsanitize=kernel-address对内存访问插桩，在运行时检测 堆缓冲区越界（heap-buffer-overflow） 和 释放后使用（use-after-free），并提供 FinSHasan_info命令进行交互式诊断。Why / 为什么需要
RT-Thread 在 MCU 目标上缺乏运行时内存安全检查（ASan 之前仅存在于 x86 模拟器）。堆越界与 use-after-free 是最常见的嵌入式内存 bug，本组件提供目标机上的运行时检测，且报告包含触发线程名与内存块归属信息。
What / 修改了哪些文件
components/asan/Kconfig：注册RT_USING_ASAN（含 shadow 大小 / track 表大小 / backtrace 开关）components/asan/SConscript：runtime 自身以-fno-sanitize=kernel-address编译避免递归components/asan/asan.c：shadow memory + 插桩访问检查 + 报告 + malloc/free/realloc hookcomponents/Kconfig：rsource "asan/Kconfig"src/SConscript：将 mem/memheap/slab 分配器移入非插桩编译组tools/building.py：GCC 下注入-fsanitize=kernel-addressHeap algorithm support / 堆算法支持
RT_USING_SMALL_MEM_AS_HEAP)RT_USING_SLAB_AS_HEAP)RT_USING_MEMHEAP_AS_HEAP)RT_USING_USERHEAP)Verification / 验证
asan_test_overflow（overflow by 2 bytes）、asan_test_uaf（USE-AFTER-FREE, offset +0）、asan_info全部命中kernel-address