Add KASAN support for detecting heap memory safety bugs (buffer
overflows, underflows, use-after-free) at runtime using compiler
instrumentation and shadow memory. Gated behind
CONFIG_IDF_EXPERIMENTAL_FEATURES, with touch points kept to esp_system
and heap so other components stay untouched.
- Core runtime (esp_system/kasan.c, esp_kasan.h): nibble-based shadow
memory in DRAM, poison/unpoison, per-access validation, and __asan_*
stubs; hot-path stubs in IRAM so they stay valid with the flash cache
off. Shadow init runs before heap bring-up.
- Heap integration (heap/heap_kasan*.c): alloc/free hooks add redzones,
a quarantine FIFO, and shadow updates.
- Panic handling: disable checks once at the panic handler entry so
backtrace and stack dumps can read redzones without nested reports.
- Build system: -fsanitize=kernel-address for app code, with HAL, SoC,
esp_rom, SPI flash, esp_hw_support, bootloader_support, FreeRTOS, and
heap internals excluded from instrumentation.
- Test app (tools/test_apps/system/kasan_test): Unity tests for
overflow, underflow, use-after-free, and all sized __asan_* stubs,
with halt and no-halt configurations.
- Docs: document KASAN in the heap memory debugging guide (EN and CN).
After startup is done and app_main is reached, all calls to
heap_caps_add_region_with_caps (adding a new heap to the list of registered
heaps) will not affect the minimum free heap size value.
For heaps created before startup, this won't apply and their size will
end up being taken into account in the calculation of the minimum.
- Destination selection is unified for SystemView and app_trace
- Destination param is removed from app_trace APIs
- Destinaiton and related configuration now can be override from users
with a callback from system_init_fn
- Place the section on alloc failed hook at a better place
- Add reference to the different poisoning configs at the beginning
of the heap corruption detectino section
- Update the information concerning heap tracing
- Update the heap tracing log examples
- Fix heap tracing standalone code:
- Update the logging format in heap_trace_dump_base
- Add freed field in trace stucture to keep this info even
when no call stack is available
The function heap_caps_check_integrity does not perform canary check on used block
as documented. The problem is fixed in the heap component but no patch is provided
for the ROM implementation.
Update the documentation with a warning for the targets supporting the TLSF implementation
in ROM feature.
Usage of `flushregs` in gdb will result in the following warning:
```
Warning: 'flushregs', an alias for the command 'maintenance flush register-cache', is deprecated.
Use 'maintenance flush register-cache'.
```
This patch updates to use the recommend command.
Signed-off-by: Daniel Mangum <georgedanielmangum@gmail.com>
Merges https://github.com/espressif/esp-idf/pull/11535
- Remove the size limit for the hash_map array from the CONFIG_HEAP_TRACE_HASH_MAP_SIZE
- Add test case for heap tracing using hashmap
- Update heap_debug.rst to document the newly added configurations in the heap component
Closes https://github.com/espressif/esp-idf/issues/11172
This commit updates the chip independent system chapters of the
programming guide for esp32s3.
Signed-off-by: Sudeep Mohanty <sudeep.mohanty@espressif.com>
