Module asan 

ABI for interfacing with KASAN shadow memory

KASAN functions by keeping an in-memory shadow map of all kernelspace memory. Each byte in the shadow map represents 8 bytes of kernel memory, which can either be accessible, partially accessible, or poisoned.

There are a range of poison values used in Popcorn2, some of which are defined by compiler ABI. In practice not all of these values are used. The current list is:

• 0xfa: Heap left redzone - memory just before a heap allocation
• 0xfb: Heap right redzone - memory just after a heap allocation
• 0xfc: Heap headers - memory used by heap internals
• 0xfd: Freed heap memory - heap memory that has recently been deallocated, and is currently in a quarantine period
• 0xf1: Stack left redzone - memory just before a stack allocation
• 0xf2: Stack mid redzone - memory between two stack allocations
• 0xf3: Stack right redzone - memory just after a stack allocation
• 0xf4: Stack guard page - the page of unmapped memory below the stack to catch stack overflows
• 0xf5: Stack after return - the stack frame of a function that has already returned, used to catch dangling references returned by a function
• 0xf8: Stack use after scope - a stack slot in the current function but is now out of scope
• 0xf9: Global redzone - memory around global variables
• 0xc0: Freed virtual memory - memory that has just been deallocated by a Vmm
• 0xc1: Uninitialized virtual memory - memory that has never been allocated
• 0xcc: Shadow gap - the shadow map itself

Re-exports

pub use super::*;

Modules

full 🔒 full

Macros

no_asan_shimfull

Constants

SHADOW_MAP_END

Address of the end of the shadow map region.

SHADOW_MAP_SHIFT

Offset to add to addr / 8 to calculate shadow map address.

SHADOW_MAP_SIZE 🔒

SHADOW_MAP_START

Address of the start of the shadow map region.

Functions

asan_free_rangefull

Marks the region from start to start + count as accessible

count_to_shadow

Converts the number of bytes into the lower bound number of bytes in the shadow map.

mem_to_shadow

Converts the passed address into the corresponding address in the shadow map.

read_shadow_map_forfull

read_shadow_map_rawfull

set_shadow_free^⚠full

Marks count entries in the shadow map starting at address as “accessible”

set_shadow_free_vmem^⚠full

Marks count entries in the shadow map starting at address as “freed virtual memory”

set_shadow_heap_free^⚠full

Marks count entries in the shadow map starting at address as “freed heap memory”

set_shadow_heap_header^⚠full

Marks count entries in the shadow map starting at address as “heap headers”.

set_shadow_heap_left^⚠full

Marks count entries in the shadow map starting at address as “heap left redzone”

set_shadow_heap_right^⚠full

Marks count entries in the shadow map starting at address as “heap right redzone”.

set_shadow_stack_left^⚠full

Marks count entries in the shadow map starting at address as “stack left redzone”

set_shadow_uninit_vmem^⚠full

Marks count entries in the shadow map starting at address as “uninitialized virtual memory”

set_shadow_use_after_scope^⚠full

Marks count entries in the shadow map starting at address as “stack use after scope”

write_shadow_map_forfull

write_shadow_map_rawfull

If idx is greater than SHADOW_MAP_END - SHADOW_MAP_START.