Skip to content

Conversation

@W-M-R
Copy link
Contributor

@W-M-R W-M-R commented Feb 3, 2026

one memory block from heap may be used to initialize into another heap pool, the new heap start with tags need to clear when judge mem is or no heapmember

Note: Please adhere to Contributing Guidelines.

Summary

This change fixes a bug in mm_heapmember() function when KASAN (Kernel Address Sanitizer) with tag-based mode is enabled.

The Problem:
When using tag-based KASAN, memory addresses are tagged with additional metadata in the upper bits. When a memory block from one heap is used to initialize another heap pool, the new heap's start/end addresses (mm_heapstart/mm_heapend) may contain KASAN tags. The original comparison logic would fail to correctly determine heap membership because it compared tagged addresses with potentially untagged memory pointers.

The Solution:
Clear KASAN tags from heap boundary addresses before performing membership checks by wrapping them with kasan_clear_tag(). This ensures accurate pointer comparisons regardless of tag state.

Changes made:

Modified pointer comparisons in both the multi-region loop (CONFIG_MM_REGIONS > 1) and single-region path
Applied kasan_clear_tag() to heap->mm_heapstart[i] and heap->mm_heapend[i] before comparison
Ensures consistent behavior whether KASAN tagging is enabled or disabled

Impact

Functionality:

Fixes incorrect heap membership detection when KASAN tag-based mode is active
Prevents potential memory corruption or access violations due to misidentified heap boundaries
No impact when KASAN is disabled (macro likely expands to no-op)
Users:

Applications using KASAN for memory debugging will see more accurate heap tracking
Prevents false negatives where valid heap members are incorrectly identified as non-members
Prevents false positives where non-heap memory is incorrectly identified as heap members
Compatibility:

Binary compatible - only changes internal comparison logic
No API changes
Backwards compatible with existing code
Security:

Improves memory safety by ensuring correct heap boundary checks under KASAN
Prevents potential use-after-free or out-of-bounds scenarios caused by incorrect heap identification

Testing

Test Platform:

File: mm_heapmember.c
Changed: 1 file, +4 insertions, -4 deletions
Test Configuration:

Enable KASAN with tag-based mode (CONFIG_MM_KASAN and tag-based variant)
Configure multiple heap regions (CONFIG_MM_REGIONS > 1)
Test Cases:

Heap initialization with tagged memory

Allocate memory block from heap A
Initialize heap B using memory from heap A
Verify mm_heapmember(heap_b, ptr) correctly identifies pointers within heap B
Confirmed tags on heap boundaries don't interfere with membership checks
Multi-region heap membership

Test pointer membership across all regions with KASAN enabled
Verify boundaries at mm_heapstart[i] and mm_heapend[i] work correctly
Confirmed no false negatives for valid heap members
Single-region heap membership

Test fallback path when CONFIG_MM_REGIONS == 1 or not defined
Verify mm_heapstart[0] and mm_heapend[0] comparisons work correctly
Cross-validation without KASAN

Verify kasan_clear_tag() macro doesn't break non-KASAN builds
Confirmed behavior unchanged when KASAN is disabled

one memory block from heap may be used to initialize into another heap pool, the new heap start with tags need to clear when judge mem is or no heapmember

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
@github-actions github-actions bot added Area: Memory Management Memory Management issues Size: XS The size of the change in this PR is very small labels Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: Memory Management Memory Management issues Size: XS The size of the change in this PR is very small

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants