• FAQ for ASAN on Android10/Android11/Android12/8155/8295

    1, How to use ASAN

    detail as:https://blog.csdn.net/suixin______/article/details/133713263

    2, How to enable ASAN in init process

    We meet some memory corruption issue in init process, source code at system/core/init. The corruption issue cause init crash and trigger kernel panic. It's hard to debug this kinds of issue via logs and dump, but we can enable ASAN in init process to detect the corruption issue. 
    Steps:

    Merge debug patch to Android.bp: 

    1. @@ -197,6 +197,17 @@ cc_binary { 
    2. recovery_available: true, 
    3. stem: "init", 
    4. defaults: ["init_defaults"], 
    5. + clang: true, 
    6. + sanitize: { 
    7. + address: true, 
    8. + }, 
    9. + cflags: [ 
    10. + "-Wno-error", 
    11. + "-fno-omit-frame-pointer",
    12. + "-O0",
    13. + "-Wno-frame-larger-than=", 
    14. + "-fsanitize-recover=address" + ],
    15.  
    16. - srcs: ["main.cpp"],
    17. + srcs: init_common_sources + ["main.cpp"],

     Modify /init/service.cpp

    1. Result Service::Start() { 
    2. post_data_ = ServiceList::GetInstance().IsPostData(); 
    3. LOG(INFO) << "starting service '" << name_ << "'..."; 
    4.  + if(!GetProperty("test.debug.init.asan", "").empty()){ 
    5.  + int *array = new int[100]; 
    6.  + delete [] array; 
    7.  + LOG(INFO) << "asan detect";
    8.  + LOG(INFO) << "array " << array[2]; 
    9.  + } std::vector descriptors; 
    10.  for(const auto& socket : sockets_) {
    11.    if (auto result = socket.Create(scon); result.ok()) {

    Compile the project system/core/init. then do steps below:

    • Push the binary file init into device /system/bin/init.
    • Reboot device.

    After device bootup set debug property test.debug.init.asan by command:

    adb shell setprop test.debug.init.asan test

    Tips: on test version please don't set test.debug.init.asan, the property it's to trigger crash and verify ASAN work.
    Try to trigger the debug code by shell command:

    1. ps -Af|grep cameraserver
    2. kill -9

    If enable ASAN in init process success, ASAN will detect the debug code happen user after free issue, then init crash, device reboot and print logs like this: 

    1. 02-16 04:46:36.067 0 0 I init : Service 'cameraserver' (pid 6417) received signal 9 
    2. 02-16 04:46:36.067 0 0 I init : Sending signal 9 to service 'cameraserver' (pid 6417) process group... 
    3. 02-16 04:46:36.068 0 0 I libprocessgroup: Successfully killed process cgroup uid 1047 pid 6417 in 0ms 
    4. 02-16 04:46:36.081 0 0 I init : starting service 'cameraserver'... 
    5. 02-16 04:46:36.081 0 0 I init : asan detect 
    6. 02-16 04:46:36.074 1 1 I init : ================================================================= 
    7. 02-16 04:46:36.076 1 1 I init : ==1==ERROR: AddressSanitizer: heap-use-after-free on

    3, How to confirm whether my executables has enabled ASAN

     Due to the way ASAN works, a library built with ASan cannot be used by an executable that's built without ASAN. In runtime situations where an ASAN library is loaded into an incorrect process, you will see unresolved symbol messages starting with:

    _asan or _sanitizer

    if use command below:

    readelf -a [name] |grep asan

    4, How to retain legacy libs together with ASAN libs

    To enable ASAN and output lib into:

    1. /system/lib[64]/asan 
    2. /vendor/lib[64]/asan

    instead of:

    1. /system/lib[64]
    2. /vendor/lib[64]

    Add the label LOCAL_MODULE_RELATIVE_PATH in the libs' Android.mk:

    1. LOCAL_CLANG := true
    2. LOCAL_SANITIZE := address
    3. LOCAL_MODULE_RELATIVE_PATH := asan

    moreover, In Android.bp use:

    relative_install_path: "asan";

    lib with ASAN will output in /data/asan/system[vendor]/lib[64] and executable with ASAN will auto use /system/bin/linker_asan[64] to search the libs from the path /data/asan at first. If you get some runtime error, diable selinux by command 'adb shell setenforce 0', kill the process and try
    again.

     If adding LOCAL_MODULE_RELATIVE_PATH  label, you need to add below in init.rc:

    'setenv LD_LIBRARY_PATH'

    Run your executable with: 'LD_LIBRARY_PATH=/system[vendor]/lib[64]/asan'.

    e.g. mediaserver add the following to the appropriate section of /init.rc
    or /init.$device$.rc or .rc:

    1. service media /system/bin/mediaserver
    2. class main
    3. user media
    4. group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
    5. ioprio rt 4
    6. writepid /dev/cpuset/foreground/tasks
    7. setenv LD_LIBRARY_PATH /system/lib/asan

    Warning: The LOCAL_MODULE_RELATIVE_PATH setting moves your library to /system[vendor]/lib[64]/asan, meaning that clobbering and rebuilding from scratch will result in the library missing from /system[vendor]/lib[64], and probably an unbootable image. That's an unfortunate limitation of the current build system. Don't clobber, before enable ASAN the project should be builded once, so that will keep default lib. Make sure two libs been generated one as default use by other executable without ASAN, and the other one used by the executable with ASAN.

    5, How to check whether the executable loads libs from /system/lib/asan folder

    reading:

    /proc/$PID/maps

    If it's not, you may need to check SELinux, like :

    1. $ adb root
    2. $ adb shell setenforce 0

    then restart the process with adb shell kill $PID

    6,  How to detect APK's memory issue

    ASAN cannot detect corruption into Java code. But it can detect bugs in the JNI libraries. For that, you'll need to build zygote which in this case is /system/bin/app_process(32|64) with ASAN. This will enable ASAN in all apps & system_server on the device at the same time. Here is an example steps to enable ASAN in zygote, shared lib libart.so and libhwui.so:

    6.1, Compile code for the project before enable ASAN

    in order to make sure default shared lib libart.so & libart.so in /system/lib[64].

    6.2, Enable ASAN in  /frameworks/base/cmds/app_process/Android.mk:

    1. LOCAL_MODULE_STEM_32 := app_process32
    2. LOCAL_MODULE_STEM_64 := app_process64
    3. LOCAL_CFLAGS += $(app_process_cflags)
    4. +LOCAL_CLANG := true
    5. +LOCAL_SANITIZE := address
    6. +LOCAL_CFLAGS += -Wno-error
    7. #Disable compiler optimization
    8. +LOCAL_CFLAGS += -O0
    9. #For these flags Please refer to section FAQ
    10. +LOCAL_CFLAGS += -Wno-frame-larger-than=
    11. +LOCAL_CFLAGS += -fsanitize-recover=address
    12. +LOCAL_CFLAGS += -fno-omit-frame-pointer

    6.3, Enable ASAN in art:

    1. Android N, Android.mk
    2. diff --git a/build/Android.common_build.mk b/build/Android.common_build.mk
    3. index 2294ddb..f4ebe20 100644
    4. --- a/build/Android.common_build.mk
    5. +++ b/build/Android.common_build.mk
    6. @@ -221,7 +221,6 @@ art_cflags := \
    7. -std=gnu++11 \
    8. -ggdb3 \
    9. -Wall \
    10. - -Werror \
    11. -Wextra \
    12. -Wstrict-aliasing \
    13. -fstrict-aliasing \
    14. diff --git a/dalvikvm/Android.mk b/dalvikvm/Android.mk
    15. index 71e9a28..ff2fa5a 100644
    16. --- a/dalvikvm/Android.mk
    17. +++ b/dalvikvm/Android.mk
    18. @@ -18,7 +18,7 @@ LOCAL_PATH := $(call my-dir)
    19. include art/build/Android.common.mk
    20. -dalvikvm_cflags := -Wall -Werror -Wextra -std=gnu++11
    21. +dalvikvm_cflags := -Wall -Wextra -std=gnu++11
    22. include $(CLEAR_VARS)
    23. LOCAL_MODULE := dalvikvm
    24. diff --git a/runtime/Android.mk b/runtime/Android.mk
    25. index aa12c83..563305e 100644
    26. --- a/runtime/Android.mk
    27. +++ b/runtime/Android.mk
    28. @@ -527,6 +527,9 @@ endif
    29. LOCAL_C_INCLUDES += art/cmdline
    30. LOCAL_C_INCLUDES += art/sigchainlib
    31. LOCAL_C_INCLUDES += art
    32. + LOCAL_SANITIZE := address
    33. + LOCAL_MULTILIB := both
    34. + LOCAL_MODULE_RELATIVE_PATH := asan
    35. ifeq ($$(art_static_or_shared),static)
    36. LOCAL_STATIC_LIBRARIES := libnativehelper
    37. Android O/P, Android.bp
    38. diff --git a/runtime/Android.bp b/runtime/Android.bp
    39. index dd9cc03..d96cca5 100644
    40. --- a/runtime/Android.bp
    41. +++ b/runtime/Android.bp
    42. @@ -276,6 +276,17 @@ cc_defaults {
    43. "arch/arm/thread_arm.cc",
    44. "arch/arm/fault_handler_arm.cc",
    45. ],
    46. + clang: true,
    47. + sanitize: {
    48. + address: true,
    49. + },
    50. + cflags: ["-Wno-frame-larger-than=",
    51. + "-fno-omit-frame-pointer",
    52. + "-O0",
    53. + "-fsanitize-recover=address",
    54. + ],
    55. },
    56. arm64: {
    57. srcs: [
    58. @@ -290,6 +301,17 @@ cc_defaults {
    59. "monitor_pool.cc",
    60. "arch/arm64/fault_handler_arm64.cc",
    61. ],
    62. + clang: true,
    63. + sanitize: {
    64. + address: true,
    65. + },
    66. + cflags: ["-Wno-frame-larger-than=",
    67. + "-fno-omit-frame-pointer",
    68. + "-O0",
    69. + "-fno-sanitize-address-use-after-scope",
    70. + "-fsanitize-recover=address",
    71. + ],
    72. },

    6.4, Enable ASAN in libhwui: 

    1. cc_defaults {
    2. name: "libhwui_defaults",
    3. defaults: ["hwui_defaults"],
    4. + cflags: [
    5. + "-Wno-error",
    6. + "-fno-omit-frame-pointer",
    7. + "-O0",
    8. + "-Wno-frame-larger-than=",
    9. + "-fsanitize-recover=address"
    10. + ],
    11. + clang: true,
    12. + sanitize: {
    13. + address: true,
    14. + },
    15. + relative_install_path: "asan",

     6.5 Set env in system/core/rootdir/init.zygote(32|64).rc:

    1. diff --git a/rootdir/init.environ.rc.in b/rootdir/init.environ.rc.in
    2. index 32817fa..2f349fb 100644
    3. --- a/rootdir/init.environ.rc.in
    4. +++ b/rootdir/init.environ.rc.in
    5. @@ -4,6 +4,7 @@ on init
    6. export ANDROID_ROOT /system
    7. export ANDROID_ASSETS /system/app
    8. export ANDROID_DATA /data
    9. + export ASAN_OPTIONS halt_on_error=0
    10. export ANDROID_STORAGE /storage
    11. export EXTERNAL_STORAGE /sdcard
    12. export ASEC_MOUNTPOINT /mnt/asec
    13. diff --git a/rootdir/init.zygote64_32.rc b/rootdir/init.zygote64_32.rc
    14. index a422fcc..f3391c1 100644
    15. --- a/rootdir/init.zygote64_32.rc
    16. +++ b/rootdir/init.zygote64_32.rc
    17. @@ -1,5 +1,8 @@
    18. service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-system-server --socket-name=zygote
    19. class main
    20. + setenv LD_LIBRARY_PATH /system/lib64/asan:/system/lib64:/system/vendor/lib64:/system/lib
    21. + setenv ASAN_OPTIONS halt_on_error=0:allow_user_segv_handler=true
    22. socket zygote stream 660 root system
    23. onrestart write /sys/android_power/request_state wake
    24. onrestart write /sys/power/state on
    25. @@ -11,6 +14,9 @@ service zygote /system/bin/app_process64 -Xzygote /system/bin --zygote --start-s
    26. service zygote_secondary /system/bin/app_process32 -Xzygote /system/bin --zygote --socket-name=zygote_secondary
    27. class main
    28. + setenv LD_LIBRARY_PATH /system/lib/asan:/system/lib:/system/vendor/lib
    29. + setenv ASAN_OPTIONS halt_on_error=0
    30. + allow_user_segv_handler=true
    31. socket zygote_secondary stream 660 root system
    32. onrestart restart zygote
    33. writepid /dev/cpuset/foreground/tasks

    6.6 Recompile system and boot image, and flash.

    In mentioned scenario ASAN is enabled for libart.so, libhwui.so & zygote. We can enable ASAN for other shared libraries using similar approach. 

    7, Can AddressSanitizer continue running after reporting first error?

    Yes it can, AddressSanitizer has recently got continue-after-error mode. This is somewhat experimental so may not yet be as reliable as default setting (and not as timely supported). Also keep
    in mind that errors after the first one may actually be spurious. To enable continue-after-error, compile with:

    -fsanitize-recover=address

    and then run your code with:

    ASAN_OPTIONS=halt_on_error=0

    8, How to build libclang_rt.asan-arm-android.so

    Modify file "./external/compiler-rt/lib/asan/Android.mk" as following:

    1. 178 #ifeq (true,$(FORCE_BUILD_SANITIZER_SHARED_OBJECTS))
    2. 179 #ifdef 2ND_ADDRESS_SANITIZER_RUNTIME_LIBRARY
    3. 180 $(eval $(call build-asan-rt-shared-library,$(ADDRESS_SANITIZER_RUNTIME_LIBRARY)
    4. ,64))
    5. 181 $(eval $(call build-asan-rt-shared-library,$(
    6. 2ND_ADDRESS_SANITIZER_RUNTIME_LIBRARY),32))
    7. 182 #else
    8. 183 # $(eval $(call build-asan-rt-shared-library,$(ADDRESS_SANITIZER_RUNTIME_LIBRARY),32))
    9. 184 #endif
    10. 185 #endif

    And then build comiler-rt:

    1. $cd /external/compiler-rt/
    2. $ mm

     After you build it successfully, you can find libclang_rt.asan-arm-android.so and libclang_rt.asan-aarch64-android.so under the path:

    /system/lib64/

    copy them to the path:

    /external/compiler-rt/lib/asan/scripts/

    Modify the script '/external/compiler-rt/lib/asan/scripts/asan_device_setup'. Change the line :

    (LD_PRELOAD=\$LD_PRELOAD:$_asan_rt \\

    as:

    LD_PRELOAD=$_asan_rt \\

    Then connect your device to your Linux PC and execute this script, If the script run success the device will reboot automatically.

    8, How to solve build error "error: 'out/target/product/xxxx/system/bin/linker_asan64'

    Issue happend on android N. On O & P its been generated auto.
    Logs:

    1. ninja: error: 'out/target/product/xxxx/system/bin/linker_asan64', needed by 'out/target/product/
    2. xxxx/system/bin/asan_test', missing and no known rule to make it
    3. make: *** [ninja_wrapper] Error 1
    4. make: Leaving directory `/mnt/android/Builds/xxxx'

    Solution: copy linker to linker_asan(32 bit & 64 bit)

    1. cp out/target/product/xxx/system/bin/linker64 out/target/product/xxx/system/bin/linker_asan64
    2. cp out/target/product/xxx/system/bin/linker out/target/product/xxx/system/bin/linker_asan

    9， How to solve build error "art/runtime/class_linker.cc:351:19: error: stack frame size of 3040 bytes "

    Logs:

    1. art/runtime/class_linker.cc:351:19: error: stack frame size of 3040 bytes in function 'art::
    2. ClassLinker::InitWithoutImage' [ -Werror,-Wframe-larger-than= ]
    3. bool ClassLinker::InitWithoutImage(std::vector>
    4. boot_class_path,
    5. ^ art/runtime/class_linker.cc:1559:19: error: stack frame size of 1824 bytes in function '
    6. art::
    7. ClassLinker::AddImageSpace' [-Werror,-Wframe-larger-than=]

    Solution:

    Add LOCAL_CFLAGS "-Werror" and "-Wno-frame-larger-than=" in Android.mk. 

    1. diff --git a/runtime/Android.mk b/runtime/Android.mk
    2. index aa12c83..e2e3075 100644--- a/runtime/Android.mk
    3. +++ b/runtime/Android.mk
    4. @@ -523,6 +523,13 @@ endif
    5. LOCAL_MULTILIB := both
    6. endif
    7. + LOCAL_CLANG := true
    8. + LOCAL_SANITIZE := address
    9. + LOCAL_MULTILIB := both
    10. ++
    11. LOCAL_CFLAGS += -Werror
    12. + LOCAL_CFLAGS += -Wno-frame-larger-than=
    13. +
    14. LOCAL_C_INCLUDES += $$(ART_C_INCLUDES)
    15. LOCAL_C_INCLUDES += art/cmdline
    16. LOCAL_C_INCLUDES += art/sigchainlib

    10, How to solve "Shadow memory range interleaves with an existing memory mapping. ASan cannot proceed correctly. ABORTING."

    he problem occur on Android O, In android P incldue the patch. Logs:

    1. 03-28 01:59:00.239 1912 1912 I : ==1912==Shadow memory range interleaves with an
    2. existing memory mapping. ASan cannot proceed correctly. ABORTING.
    3. 03-28 01:59:00.239 1912 1912 I :
    4. 03-28 01:59:00.239 1912 1912 I : ==1912==ASan shadow was supposed to be located in the
    5. [0x00000000-0x1fffffff] range.
    6. 03-28 01:59:00.239 1912 1912 I :
    7. 03-28 01:59:00.249 1912 1912 I : ==1912==Process memory map follows:
    8. 03-28 01:59:00.249 1912 1912 I :
    9. 03-28 01:59:00.249 1912 1912 I : 0x0ed56000-0x0ed5d000 /system/bin/app_process32
    10. 03-28 01:59:00.249 1912 1912 I :
    11. 03-28 01:59:00.249 1912 1912 I : 0x0ed5d000-0x0ed5e000 /system/bin/app_process32

    merge below kernel patch. Rebuild and reflash boot.img”:

    1. Change-Id: Iceaba90a3745323288be01f73aa51f4f4dbbda16
    2. ---
    3. arch/arm64/include/asm/elf.h | 12 ++++++------
    4. 1 file changed, 6 insertions(+), 6 deletions(-)diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
    5. index b983322..a383c28 100644
    6. --- a/arch/arm64/include/asm/elf.h
    7. +++ b/arch/arm64/include/asm/elf.h
    8. @@ -114,11 +114,12 @@
    9. #define ELF_EXEC_PAGESIZE PAGE_SIZE
    10. /*
    11. - * This is the base location for PIE (ET_DYN with INTERP) loads. On
    12. - * 64-bit, this is raised to 4GB to leave the entire 32-bit address
    13. - * space open for things that want to use the area for 32-bit pointers.
    14. + * This is the location that an ET_DYN program is loaded if exec'ed. Typical
    15. + * use of this is to invoke "./ld.so someprog" to test out a new version of
    16. + * the loader. We need to make sure that it is out of the way of the program
    17. + * that it will "exec", and that there is sufficient room for the brk.
    18. */
    19. -#define ELF_ET_DYN_BASE 0x100000000UL
    20. +#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
    21. #ifndef __ASSEMBLY__
    22. @@ -169,8 +170,7 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
    23. #ifdef CONFIG_COMPAT
    24. -/* PIE load location for compat arm. Must match ARM ELF_ET_DYN_BASE. */
    25. -#define COMPAT_ELF_ET_DYN_BASE 0x000400000UL
    26. +#define COMPAT_ELF_ET_DYN_BASE (2 * TASK_SIZE_32 / 3)
    27. /* AArch32 registers. */
    28. #define COMPAT_ELF_NGREG 18

    11, How to solve malloc stacktraces are too short or do not make sense

    Try to compile your code with:

    -fno-omit-frame-pointer

    or set:

    ASAN_OPTIONS=fast_unwind_on_malloc=0

    the latter would be a performance killer though unless you also specify malloc_context_size=2 or lower. Note that frame-pointer-based unwinding does not work on Thumb.

    12, How to detect overflow issue

    disable compiler optimization by add cflags

     LOCAL_CFLAGS += -O0

    To get a reasonable performance add -O1 or higher.

    13, Share examples

    13.1 Use after free

    1. int main(int argc, char **argv) {
    2.   int *array = new int[100];
    3.   delete [] array;
    4.   return array[argc]; // BOOM
    5. }

    clang -O -g -fsanitize=address %t && ./a.out 

    1. =================================================================
    2. ==6254== ERROR: AddressSanitizer: heap-use-after-free on address 0x603e0001fc64 at pc 0x417f6a bp 0x7fff626b3250 sp 0x7fff626b3248
    3. READ of size 4 at 0x603e0001fc64 thread T0
    4. #0 0x417f69 in main example_UseAfterFree.cc:5
    5. #1 0x7fae62b5076c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    6. #2 0x417e54 (a.out+0x417e54)
    7. 0x603e0001fc64 is located 4 bytes inside of 400-byte region [0x603e0001fc60,0x603e0001fdf0)
    8. freed by thread T0 here:
    9. #0 0x40d4d2 in operator delete[](void*) /home/kcc/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:61
    10. #1 0x417f2e in main example_UseAfterFree.cc:4
    11. previously allocated by thread T0 here:
    12. #0 0x40d312 in operator new[](unsigned long) /home/kcc/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:46
    13. #1 0x417f1e in main example_UseAfterFree.cc:3
    14. Shadow bytes around the buggy address:
    15. 0x1c07c0003f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    16. 0x1c07c0003f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    17. 0x1c07c0003f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    18. 0x1c07c0003f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    19. 0x1c07c0003f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    20. =>0x1c07c0003f80: fa fa fa fa fa fa fa fa fa fa fa fa[fd]fd fd fd
    21. 0x1c07c0003f90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    22. 0x1c07c0003fa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    23. 0x1c07c0003fb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
    24. 0x1c07c0003fc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    25. 0x1c07c0003fd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    26. Shadow byte legend (one shadow byte represents 8 application bytes):
    27. Addressable: 00
    28. Partially addressable: 01 02 03 04 05 06 07
    29. Heap left redzone: fa
    30. Heap righ redzone: fb
    31. Freed Heap region: fd
    32. Stack left redzone: f1
    33. Stack mid redzone: f2
    34. Stack right redzone: f3
    35. Stack partial redzone: f4
    36. Stack after return: f5
    37. Stack use after scope: f8
    38. Global redzone: f9
    39. Global init order: f6
    40. Poisoned by user: f7
    41. ASan internal: fe

    13.2 Heap buffer overflow：

    1. int main(int argc, char **argv) {
    2.     int *array = new int[100];
    3.     array[0] = 0;
    4.     int res = array[argc + 100]; // BOOM
    5.     delete [] array;
    6.     return res;
    7. }
    1. =================================================================
    2. ==6226== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603e0001fdf4 at pc 0x417f8c bp 0x7fff64c0c010 sp 0x7fff64c0c008
    3. READ of size 4 at 0x603e0001fdf4 thread T0
    4. #0 0x417f8b in main example_HeapOutOfBounds.cc:5
    5. #1 0x7fa97c09376c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    6. #2 0x417e54 (a.out+0x417e54)
    7. 0x603e0001fdf4 is located 4 bytes to the right of 400-byte region [0x603e0001fc60,0x603e0001fdf0)
    8. allocated by thread T0 here:
    9. #0 0x40d312 in operator new[](unsigned long) /home/kcc/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:46
    10. #1 0x417f1c in main example_HeapOutOfBounds.cc:3
    11. Shadow bytes around the buggy address:
    12. 0x1c07c0003f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    13. 0x1c07c0003f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    14. 0x1c07c0003f80: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
    15. 0x1c07c0003f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    16. 0x1c07c0003fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    17. =>0x1c07c0003fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa
    18. 0x1c07c0003fc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    19. 0x1c07c0003fd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    20. 0x1c07c0003fe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    21. 0x1c07c0003ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    22. 0x1c07c0004000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    23. Shadow byte legend (one shadow byte represents 8 application bytes):
    24. Addressable: 00
    25. Partially addressable: 01 02 03 04 05 06 07
    26. Heap left redzone: fa
    27. Heap righ redzone: fb
    28. Freed Heap region: fd
    29. Stack left redzone: f1
    30. Stack mid redzone: f2
    31. Stack right redzone: f3
    32. Stack partial redzone: f4
    33. Stack after return: f5
    34. Stack use after scope: f8
    35. Global redzone: f9
    36. Global init order: f6
    37. Poisoned by user: f7
    38. ASan internal: fe
    39. ==6226== ABORTING

    13.3 Stack buffer overflow:

    1. int main(int argc, char **argv) {
    2.     int stack_array[100];
    3.     stack_array[1] = 0;
    4.     return stack_array[argc + 100]; // BOOM
    5. }
    1. =================================================================
    2. ==6240== ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff8098b2b4 at pc 0x417fe1 bp 0x7fff8098b0f0 sp 0x7fff8098b0e8
    3. READ of size 4 at 0x7fff8098b2b4 thread T0
    4. #0 0x417fe0 in main example_StackOutOfBounds.cc:5
    5. #1 0x7fa3667c976c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    6. #2 0x417e54 (a.out+0x417e54)
    7. Address 0x7fff8098b2b4 is located at offset 436 in frame 
       of T0's stack:
    8. This frame has 1 object(s):
    9. [32, 432) 'stack_array'
    10. HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
    11. (longjmp and C++ exceptions *are* supported)
    12. Shadow bytes around the buggy address:
    13. 0x1ffff0131600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    14. 0x1ffff0131610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    15. 0x1ffff0131620: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
    16. 0x1ffff0131630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    17. 0x1ffff0131640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    18. =>0x1ffff0131650: 00 00 00 00 00 00[f4]f4 f3 f3 f3 f3 00 00 00 00
    19. 0x1ffff0131660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    20. 0x1ffff0131670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    21. 0x1ffff0131680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    22. 0x1ffff0131690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    23. 0x1ffff01316a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    24. Shadow byte legend (one shadow byte represents 8 application bytes):
    25. Addressable: 00
    26. Partially addressable: 01 02 03 04 05 06 07
    27. Heap left redzone: fa
    28. Heap righ redzone: fb
    29. Freed Heap region: fd
    30. Stack left redzone: f1
    31. Stack mid redzone: f2
    32. Stack right redzone: f3
    33. Stack partial redzone: f4
    34. Stack after return: f5
    35. Stack use after scope: f8
    36. Global redzone: f9
    37. Global init order: f6
    38. Poisoned by user: f7
    39. ASan internal: fe
    40. ==6240== ABORTING

     13.4 Global buffer overflow:

    1. int global_array[100] = {-1};
    2. int main(int argc, char **argv) {
    3.     return global_array[argc + 100]; // BOOM
    4. }
    1. =================================================================
    2. ==6211== ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000622314 at pc 0x417fee bp 0x7fff2e146300 sp 0x7fff2e1462f8
    3. READ of size 4 at 0x000000622314 thread T0
    4. #0 0x417fed in main example_GlobalOutOfBounds.cc:4
    5. #1 0x7f1c10d2a76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    6. #2 0x417ef4 (a.out+0x417ef4)
    7. 0x000000622314 is located 4 bytes to the right of global variable 'global_array (example_GlobalOutOfBounds.cc)' (0x622180) of size 400
    8. Shadow bytes around the buggy address:
    9. 0x1000000c4410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    10. 0x1000000c4420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    11. 0x1000000c4430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    12. 0x1000000c4440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    13. 0x1000000c4450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    14. =>0x1000000c4460: 00 00[f9]f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
    15. 0x1000000c4470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    16. 0x1000000c4480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    17. 0x1000000c4490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    18. 0x1000000c44a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    19. 0x1000000c44b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    20. Shadow byte legend (one shadow byte represents 8 application bytes):
    21. Addressable: 00
    22. Partially addressable: 01 02 03 04 05 06 07
    23. Heap left redzone: fa
    24. Heap righ redzone: fb
    25. Freed Heap region: fd
    26. Stack left redzone: f1
    27. Stack mid redzone: f2
    28. Stack right redzone: f3
    29. Stack partial redzone: f4
    30. Stack after return: f5
    31. Stack use after scope: f8
    32. Global redzone: f9
    33. Global init order: f6
    34. Poisoned by user: f7
    35. ASan internal: fe
    36. ==6211== ABORTING

      13.5 Use after return:

    1. // RUN: clang -O -g -fsanitize=address %t && ./a.out
    2. // By default, AddressSanitizer does not try to detect
    3. // stack-use-after-return bugs.
    4. // It may still find such bugs occasionally
    5. // and report them as a hard-to-explain stack-buffer-overflow.
    6. // You need to run the test with ASAN_OPTIONS=detect_stack_use_after_return=1
    7.  
    8. int *ptr;
    9. __attribute__((noinline))
    10. void FunctionThatEscapesLocalObject() {
    11.     int local[100];
    12.     ptr = &local[0];
    13. }
    14.  
    15. int main(int argc, char **argv) {
    16.     FunctionThatEscapesLocalObject();
    17.     return ptr[argc];
    18. }
    1. =================================================================
    2. ==6268== ERROR: AddressSanitizer: stack-use-after-return on address 0x7fa19a8fc024 at pc 0x4180d5 bp 0x7fff73c3fc50 sp 0x7fff73c3fc48
    3. READ of size 4 at 0x7fa19a8fc024 thread T0
    4. #0 0x4180d4 in main example_UseAfterReturn.cc:17
    5. #1 0x7fa19b11d76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
    6. #2 0x417f34 (a.out+0x417f34)
    7. Address 0x7fa19a8fc024 is located at offset 36 in frame <_Z30FunctionThatEscapesLocalObjectv> of T0's stack:
    8. This frame has 1 object(s):
    9. [32, 432) 'local'
    10. HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
    11. (longjmp and C++ exceptions *are* supported)
    12. Shadow bytes around the buggy address:
    13. 0x1ff43351f7b0: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
    14. 0x1ff43351f7c0: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
    15. 0x1ff43351f7d0: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
    16. 0x1ff43351f7e0: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
    17. 0x1ff43351f7f0: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
    18. =>0x1ff43351f800: f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    19. 0x1ff43351f810: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    20. 0x1ff43351f820: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    21. 0x1ff43351f830: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 00 00 00 00
    22. 0x1ff43351f840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    23. 0x1ff43351f850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    24. Shadow byte legend (one shadow byte represents 8 application bytes):
    25. Addressable: 00
    26. Partially addressable: 01 02 03 04 05 06 07
    27. Heap left redzone: fa
    28. Heap righ redzone: fb
    29. Freed Heap region: fd
    30. Stack left redzone: f1
    31. Stack mid redzone: f2
    32. Stack right redzone: f3
    33. Stack partial redzone: f4
    34. Stack after return: f5
    35. Stack use after scope: f8
    36. Global redzone: f9
    37. Global init order: f6
    38. Poisoned by user: f7
    39. ASan internal: fe
    40. ==6268== ABORTING

    13.6 Use after scope: 

    1. // RUN: clang -O -g -fsanitize=address -fsanitize-address-use-after-scope \
    2. // use-after-scope.cpp -o /tmp/use-after-scope
    3. // RUN: /tmp/use-after-scope
    4. // Check can be disabled in run-time:
    5. // RUN: ASAN_OPTIONS=detect_stack_use_after_scope=0 /tmp/use-after-scope
    6.  
    7. volatile int *p = 0;
    8. int main() {
    9.   {
    10.      int x = 0;
    11.      p = &x;
    12.   }
    13.   *p = 5;
    14.   return 0;
    15. }
    1. =================================================================
    2. ==58237==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffc4d830880 at pc 0x0000005097ed bp 0x7ffc4d830850 sp 0x7ffc4d830848
    3. WRITE of size 4 at 0x7ffc4d830880 thread T0
    4. #0 0x5097ec (/tmp/use-after-scope+0x5097ec)
    5. #1 0x7ff85fa6bf44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    6. #2 0x41a005 (/tmp/use-after-scope+0x41a005)
    7. Address 0x7ffc4d830880 is located in stack of thread T0 at offset 32 in frame
    8. #0 0x5096ef (/tmp/use-after-scope+0x5096ef)
    9. This frame has 1 object(s):
    10. [32, 36) 'x' <== Memory access at offset 32 is inside this variable
    11. HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
    12. (longjmp and C++ exceptions *are* supported)
    13. SUMMARY: AddressSanitizer: stack-use-after-scope (/tmp/use-after-scope+0x5097ec)
    14. Shadow bytes around the buggy address:
    15. 0x100009afe0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    16. 0x100009afe0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    17. 0x100009afe0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    18. 0x100009afe0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    19. 0x100009afe100: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
    20. =>0x100009afe110:[f8]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    21. 0x100009afe120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    22. 0x100009afe130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    23. 0x100009afe140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    24. 0x100009afe150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    25. 0x100009afe160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    26. Shadow byte legend (one shadow byte represents 8 application bytes):
    27. Addressable: 00
    28. Partially addressable: 01 02 03 04 05 06 07
    29. Heap left redzone: fa
    30. Heap right redzone: fb
    31. Freed heap region: fd
    32. Stack left redzone: f1
    33. Stack mid redzone: f2
    34. Stack right redzone: f3
    35. Stack partial redzone: f4
    36. Stack after return: f5
    37. Stack use after scope: f8
    38. Global redzone: f9
    39. Global init order: f6
    40. Poisoned by user: f7
    41. Container overflow: fc
    42. Array cookie: ac
    43. Intra object redzone: bb
    44. ASan internal: fe
    45. Left alloca redzone: ca
    46. Right alloca redzone: cb
    47. ==58237==ABORTING

  • 相关阅读:
    在Unity中，Instantiate函数用于在场景中创建一个新的游戏对象实例
    SpringNative GraalVM 打包 SpringBoot 为 Linux 的 单文件应用程序
    JavaWeb — JSTL标签库
    switch&循环语句
    smartmontools-5.43交叉编译Smartctl
    选择护眼台灯的标准，教大家如何挑选护眼灯
    Linux安装软件通用办法总结及注意事项(全局运行、守护进程、自启动,开放服务端口)
    hdfs集群数据迁移/DataNode节点维护/集群重命名--小结
    Rust5.2 Generic Types, Traits, and Lifetimes
    Maven 如何配置推送的仓库
  • 原文地址：https://blog.csdn.net/suixin______/article/details/139656510