Module asan 

ABI for interfacing with KASAN shadow memory.

TODO(doc): overview of kasan?

KASAN functions by keeping an in-memory shadow map of all kernelspace memory. Each byte in the shadow map represents 8 bytes of kernel memory, which can either be accessible, partially accessible, or poisoned.

There are a range of poison values used in Popcorn2, some of which are defined by compiler ABI. In practice not all of these values are used. The current list is:

• 0xfa: Heap left redzone - memory just before a heap allocation
• 0xfb: Heap right redzone - memory just after a heap allocation
• 0xfc: Heap headers - memory used by heap internals
• 0xfd: Freed heap memory - heap memory that has recently been deallocated, and is currently in a quarantine period
• 0xf1: Stack left redzone - memory just before a stack allocation
• 0xf2: Stack mid redzone - memory between two stack allocations
• 0xf3: Stack right redzone - memory just after a stack allocation
• 0xf4: Stack guard page - the page of unmapped memory below the stack to catch stack overflows
• 0xf5: Stack after return - the stack frame of a function that has already returned, used to catch dangling references returned by a function
• 0xf8: Stack use after scope - a stack slot in the current function but is now out of scope
• 0xf9: Global redzone - memory around global variables
• 0xc0: Freed virtual memory - memory that has just been deallocated by a Vmm
• 0xc1: Uninitialized virtual memory - memory that has never been allocated
• 0xcc: Shadow gap - the shadow map itself

The entire region from SHADOW_MAP_START through to SHADOW_MAP_END is safe to read and write to as a [u8], since any unmapped memory will be automatically mapped. Helper functions for this are provided as read_shadow_map_for/write_shadow_map_for and read_shadow_map_raw/write_shadow_map_raw.

Re-exports

pub use super::*;

Macros

no_asan_shimfull

Prevents the contained code from being checked with the address sanitizer.

Constants

SHADOW_MAP_END

Address of the end of the shadow map region.

SHADOW_MAP_SHIFT

Offset to add to addr / 8 to calculate shadow map address.

SHADOW_MAP_START

Address of the start of the shadow map region.

Functions

asan_free_rangefull

Marks the region from start to start + count as accessible.

count_to_shadow

Converts the number of bytes into the lower bound number of bytes in the shadow map.

mem_to_shadow

Converts the passed address into the corresponding address in the shadow map.

read_shadow_map_forfull

Reads the value of the shadow map for addr.

read_shadow_map_rawfull

Reads the value of the shadow map at the index idx.

set_shadow_free^⚠full

Marks count entries in the shadow map starting at address as accessible.

set_shadow_free_vmem^⚠full

Marks count entries in the shadow map starting at address as freed virtual memory.

set_shadow_heap_free^⚠full

Marks count entries in the shadow map starting at address as freed heap memory.

set_shadow_heap_header^⚠full

Marks count entries in the shadow map starting at address as heap headers.

set_shadow_heap_left^⚠full

Marks count entries in the shadow map starting at address as heap left redzone.

set_shadow_heap_right^⚠full

Marks count entries in the shadow map starting at address as heap right redzone.

set_shadow_stack_left^⚠full

Marks count entries in the shadow map starting at address as stack left redzone.

set_shadow_uninit_vmem^⚠full

Marks count entries in the shadow map starting at address as uninitialized virtual memory.

set_shadow_use_after_scope^⚠full

Marks count entries in the shadow map starting at address as stack use after scope.

write_shadow_map_forfull

Write val to the shadow map for addr.

write_shadow_map_rawfull

Write val to the shadow map at the index idx.