Memory corruption
对于系统中出现随机、不可解释的异常指针访问或数据错误导致的异常，一般要考虑是内存使用上出现了 UAF（Use-After-Free），OOB（Out-of-Bounds）。
本章所指的”Memory corruption”特指 Linux kernel 侧出现的”Memory corruption”，子系统间的内存踩踏请参考 Firewall 。
通用方法
当怀疑系统有 OOB、UAF 类问题时，打开 CONFIG_KASAN 开关，进行复现。
当出现 memory corruption 问题时，系统默认会 BUG_ON。
检查 panic log 信息，对于 slub、stack、buddy page、全局变量的 UAF 和 OOB 均有关键信息指出，基本通过 log 能够解决所有问题。
典型问题
[ 6.262525] BUG: KASAN: global-out-of-bounds in __of_match_node+0x70/0xb8
[ 6.263391] Read of size 1 at addr ffffff9008d153a8 by task swapper/0/1
[ 6.264231]
[ 6.264439] CPU: 5 PID: 1 Comm: swapper/0 Not tainted 6.1.94-rt33-gac7c113a9bab #2
[ 6.265488] Hardware name: Horizon Robotics 征程 6E Evaluation Module Board （DT）
[ 6.266362] Call trace:
[ 6.266694] [] dump_backtrace+0x0/0x538
[ 6.267391] [] show_stack+0x14/0x20
[ 6.268048] [] dump_stack+0xa4/0xc8
[ 6.268703] [] print_address_description+0x1e4/0x250
[ 6.269539] [] kasan_report+0x2cc/0x300
[ 6.270240] [] __asan_load1+0x44/0x50
[ 6.270912] [] __of_match_node+0x70/0xb8
[ 6.271617] [] of_match_node+0x38/0x60
[ 6.272301] [] of_match_device+0x3c/0x50
[ 6.273012] [] platform_match+0x64/0x118
[ 6.273719] [] __driver_attach+0x40/0x140
[ 6.274435] [] bus_for_each_dev+0xcc/0x140
[ 6.275164] [] driver_attach+0x30/0x40
[ 6.275848] [] bus_add_driver+0x220/0x388
[ 6.276566] [] driver_register+0x108/0x170
[ 6.277295] [] __platform_driver_register+0x7c/0x88
[ 6.278122] [] 征程 6_wdt_driver_init+0x34/0x4c
[ 6.278861] [] do_one_initcall+0xe4/0x1b8
[ 6.279581] [] kernel_init_freeable+0x1ac/0x260
[ 6.280363] [] kernel_init+0x10/0x118
[ 6.281036] [] ret_from_fork+0x10/0x18
[ 6.281713]
[ 6.281911] The buggy address belongs to the variable:
[ 6.282570] 0xffffff9008d153a8
[ 6.282974]
[ 6.283173] Memory state around the buggy address:
[ 6.283794] ffffff9008d15280: fa fa fa fa 07 fa fa fa fa fa fa fa 00 00 00 00
[ 6.284715] ffffff9008d15300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 6.285636] >ffffff9008d15380: 00 00 00 00 00 fa fa fa fa fa fa fa 00 00 00 00
[ 6.286552] ^
[ 6.287137] ffffff9008d15400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 6.288057] ffffff9008d15480: 00 00 00 fa fa fa fa fa 00 00 fa fa fa fa fa fa
[ 6.288974] ==================================================================
[ 6.289890] Disabling lock debugging due to kernel taint
错误类型 global-out-of-bounds，全局变量越界访问，越界读取访问一个字节。
检查 Calltrace 是在驱动 probe 匹配 device、driver 的过程中。
复杂问题可能需要检查 trace 后面 buggy address（并非实际数据地址，而是在 shadow 区的映射）信息综合分析，此问题可以看到要访问地址 ffffff9008d153a8 里数据为 0xFA，0xFA 代表全局变量的 redzone（越界检测）。
检查逻辑__of_match_node 过程是循环遍历 of_match_table 中所有的项，直到表项中成员为空退出循环。
const struct of_device_id *__of_match_node(const struct of_device_id *matches,
const struct device_node *node)
{
const struct of_device_id *best_match = NULL;
int score, best_score = 0;
if (!matches)
return NULL;
for (; matches->name[0] |matches->type[0] |matches->compatible[0]; matches++) {
score = __of_device_is_compatible(node, matches->compatible,
matches->type, matches->name);
if (score > best_score) {
best_match = matches;
best_score = score;
}
}
return best_match;
}
根据代码可知，越界原因是 of_match_table 变量尾部没有填充 0。
#ifdef CONFIG_OF
static const struct of_device_id 征程 6_wdt_of_match[] = {
- { .compatible = “snps，征程 6_wdt”， }
- /* sentinel */
- { .compatible = “snps，征程 6_wdt”， }，
- {/* sentinel/} /PRQA S 1041/};MODULE_DEVICE_TABLE（of， 征程 6_wdt_of_match）； /PRQA S 0605 */
#endif
