Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gdb-kasan: Add gdb kasan script #15536

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

gdb-kasan: Add gdb kasan script #15536

wants to merge 1 commit into from

Conversation

W-M-R
Copy link
Contributor

@W-M-R W-M-R commented Jan 14, 2025

Note: Please adhere to Contributing Guidelines.

Summary

GDB source kasan.py script, use kasandebug command to determine the legitimacy of the Heap address, currently supports two types of KASan debugging, and it also supports checking the legitimacy of Data and Bss segment addresses

1. General KASan
2. Software tag KASan
3. KASan Globals

Impact

Update this section, where applicable, on how change affects users,
build process, hardware, documentation, security, compatibility, etc.

Testing


static bool test_heap_underflow(FAR struct mm_heap_s *heap, size_t size)
{
  FAR uint8_t *mem = mm_malloc(heap, size);
  *(mem - 1) = 0x12;
  return false;
}

Generic KASan examples:

nsh> kasantest
spawn_execattrs: Setting policy=2 priority=101 for pid=3
nxtask_activate: kasantest pid=3,TCB=0x4021bb70
KASan test: heap underflow
nxtask_activate: kasantest pid=4,TCB=0x4021dfa0
kasan_report: kasan detected a write access error, address at 0x40213667,size is 1, return address: 0x62f82c
kasan_show_memory: Shadow bytes around the buggy address:
kasan_show_memory:   0x40213610: 18 36 21 40 f8 35 21 40 00 00 00 00 00 00 00 00
kasan_show_memory:   0x40213620: 28 36 21 40 08 36 21 40 00 00 00 00 00 00 00 00
kasan_show_memory:   0x40213630: 38 36 21 40 18 36 21 40 00 00 00 00 00 00 00 00
kasan_show_memory:   0x40213640: 00 00 00 00 28 36 21 40 00 00 00 00 20 3a 65 00
kasan_show_memory:   0x40213650: f0 34 21 40 5c 91 21 40 00 00 00 00 09 00 00 00
kasan_show_memory:   0x40213660: 00 00 00 00 11 00 00[00 b8 35 21 40 a8 35 21 40
kasan_show_memory:   0x40213670: 00 00 00 00 08 25 00 00 b8 35 21 40 a8 35 21 40
kasan_show_memory:   0x40213680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kasan_show_memory:   0x40213690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kasan_show_memory:   0x402136a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
dump_assert_info: Current Version: NuttX  0.0.0 8599c6bb10-dirty Jan 14 2025 17:05:39 arm
dump_assert_info: Assertion failed panic: at file: kasan/hook.c:189 task: kasantest process: kasantest 0x630ce0
up_dump_register: R0: 402117a0 R1: 4021dfe8 R2: 47c0ce80  R3: 00000000
up_dump_register: R4: 4021dfa0 R5: 402117a0 R6: 006428d3  R7: 006428d9
up_dump_register: R8: 40210de0 SB: 00000006 SL: 000000bd  FP: 0064289e
up_dump_register: IP: 4021dfe4 SP: 40220060 LR: 00606964  PC: 00606964
up_dump_register: CPSR: 600000df

What happened is heap underflow. It can be clearly analyzed that the address 0x40213667 is inaccessible,
but the next byte 0x40213668 is accessible. For details, see kasantest:

At this time, access gdb:
(gdb) kasandebug 0x40213667
Addr 0x40213667 Error
(gdb) kasandebug 0x40213666
Addr 0x40213666 Error
(gdb) kasandebug 0x40213668
Addr 0x40213668 OK

Softtags KASan examples:

NuttShell (NSH)
nsh> kasantest
KASan test: heap underflow
kasan_report: kasan detected a write access error, address at 0x1b0000004041245f,size is 1, return address: 0x4029e190
kasan_show_memory: Shadow bytes around the buggy address:
kasan_show_memory:   0x1b00000040412400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kasan_show_memory:   0x1b00000040412410: 00 00 00 00 00 00 00 00 e0 23 41 40 00 00 00 00
kasan_show_memory:   0x1b00000040412420: 00 00 00 00 00 00 00 00 40 94 3c 40 00 00 00 00
kasan_show_memory:   0x1b00000040412430: 98 21 41 40 00 00 00 00 90 b2 41 40 00 00 00 00
kasan_show_memory:   0x1b00000040412440: 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00
kasan_show_memory:   0x1b00000040412450: 00 00 00 00 00 00 00 00 59 0f 00 00 00 00 00[00
kasan_show_memory:   0x1b00000040412460: 00 23 41 40 00 00 00 00 e0 22 41 40 00 00 00 00
kasan_show_memory:   0x1b00000040412470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kasan_show_memory:   0x1b00000040412480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kasan_show_memory:   0x1b00000040412490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
dump_assert_info: Current Version: NuttX  0.0.0 8599c6bb10-dirty Jan 14 2025 17:15:58 arm64
dump_assert_info: Assertion failed panic: at file: kasan/hook.c:189 task: kasantest process: kasantest 0x4029f3f4

(gdb) kasandebug 0x1b0000004041245f
Addr 0x1b0000004041245f Error
(gdb) kasandebug 0x1b00000040412460
Addr 0x1b00000040412460 OK
(gdb)

GDB source kasan.py script, use kasandebug command to determine the legitimacy of the Heap address
Currently supports two types of KASan debugging:
1. General KASan
2. Software tag KASan
It also supports checking the legitimacy of Data and Bss segment addresses,

Signed-off-by: wangmingrong1 <[email protected]>
@github-actions github-actions bot added Area: Tooling Size: M The size of the change in this PR is medium labels Jan 14, 2025
@nuttxpr
Copy link

nuttxpr commented Jan 14, 2025

[Experimental Bot, please feedback here]

## Does this PR meet the NuttX Requirements?

Yes, this PR appears to meet the requirements, but the Impact section needs to be completed.

## Summary

The summary is clear and concisely describes the change: adding a GDB script `kasan.py` and the `kasandebug` command to facilitate debugging Kernel Address Sanitizer (KASan) issues.  It mentions support for both general and software tag KASan, as well as checking data and BSS segment addresses. The examples are helpful but would be better placed in the Testing section.

## Impact

**This section needs to be filled out completely.**  The current placeholder text needs to be replaced with specifics.  Based on the summary, the following impacts are likely and need to be confirmed/detailed:

* **Is new feature added?** YES - `kasandebug` GDB command and associated script.
* **Impact on user (will user need to adapt to change)?**  Potentially YES if users were previously using other methods for KASan debugging.  Describe the new workflow and how it compares to previous methods, if any.
* **Impact on build (will build process change)?**  Likely NO.  Confirm this.  If KASan is enabled, will the build process be affected?
* **Impact on hardware (will arch(s) / board(s) / driver(s) change)?**  Likely NO. Confirm this.
* **Impact on documentation (is update required / provided)?** YES. Document the new `kasandebug` command, the `kasan.py` script, and its usage.  Mention where this documentation is provided (e.g., in the GDB documentation, a separate README, etc.).
* **Impact on security (any sort of implications)?**  Potentially YES.  KASan itself is a security feature.  Does this change improve or weaken existing security measures?  Does it introduce any new potential vulnerabilities?
* **Impact on compatibility (backward/forward/interoperability)?** Likely NO.  Confirm this. Does it affect compatibility with different versions of GDB?
* **Anything else to consider?**  Consider mentioning any performance implications of using the `kasandebug` command.


## Testing

The testing section provides good examples of the `kasandebug` command in action, demonstrating its use in detecting heap underflow errors with both general and software tag KASan.  However, the "Testing logs before change" section is missing.  Since this is a new feature, it may not be strictly required, but it's helpful to show the difficulty of debugging KASan issues *before* this change.  Perhaps show the manual process previously required.

**Recommendations for improvement:**

* **Complete the Impact section.**  This is crucial for reviewers to understand the consequences of merging this PR.
* **Consider adding "before change" logs (or a description of the previous debugging process) to the Testing section.**  This helps highlight the value of the new feature.
* **Move the examples from the Summary section to the Testing section.** This makes the summary more concise and keeps all testing-related information together.
* **Clarify where the documentation is provided.** This makes it easy for users to find information about the new feature.


By addressing these points, the PR will be even stronger and easier for reviewers to evaluate.

class KASan(gdb.Command):

def __init__(self):
super().__init__("kasandebug", gdb.COMMAND_USER)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
super().__init__("kasandebug", gdb.COMMAND_USER)
super().__init__("kasan", gdb.COMMAND_USER)

@W-M-R W-M-R marked this pull request as draft January 14, 2025 10:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area: Tooling Size: M The size of the change in this PR is medium
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants