Android HW-Assisted Address Sanitizer for Memory Overflow checking

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Android HW-Assisted Address Sanitizer for Memory Overflow checking

Android HW-Assisted Address Sanitizer for Memory Overflow checking

Android HW-assisted Address Sanitizer for Memory Overflow checking

 

    Hardware-assisted AddressSanitizer (HWASan) is a memory error detection tool.

    HWASan is based on the memory tagging approach, where a small random tag value is associated both with pointers and with ranges of memory addresses. For a memory access to be valid, the pointer and memory tags have to match.

    HWASan uses a lot less RAM compared to ASan, which makes it suitable for whole system sanitization.

 

Here show an example: Use HWAsan for WiFi-HAL Memory Overflow issue hunting in Android-13.0.0_2.3.0_auto BSP.

    Test environment:

        SW:   Android-13.0.0_2.3.0_auto_car2, pre-built image.

        HW:  88W9098 WiFi/BT EVK (PCIe) + i.MX8QXP EVK.

 

    Run 88W9098 WiFi/BT on i.MX8QXP EVK, after ~2 hours, got memory leakage.

 

    To locate root cause, enabled HWASan, re-build Android-13.0.0_2.3.0_auto BSP, run again, Got HWAddressSanitizer report: “heap-buffer-overflow”.

         --Reason>  "Empty or null ScanResult list"  -> 

         --Then>      "Attempt to retrieve OsuProviders with invalid scanResult List" ->

         --Result>    "heap-buffer-overflow"

 

      HWASan help to locate root cause of Memory Overflow issue, on WiFi AP Scan code.

 

      Attach file:

           "Android_HW-assisted-Address-Sanitizer_for_memory-overflow_checking.pdf"

Attachments
%3CLINGO-SUB%20id%3D%22lingo-sub-1852621%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3EAndroid%20HW-Assisted%20Address%20Sanitizer%20for%20Memory%20Overflow%20checking%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1852621%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3E%3CP%3EAndroid%20HW-assisted%20Address%20Sanitizer%20for%20Memory%20Overflow%20checking%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Hardware-assisted%20AddressSanitizer%20(HWASan)%20is%20a%20memory%20error%20detection%20tool.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20HWASan%20is%20based%20on%20the%26nbsp%3Bmemory%20tagging%20approach%2C%20where%20a%20small%20random%20tag%20value%20is%20associated%20both%20with%20pointers%20and%20with%20ranges%20of%20memory%20addresses.%20For%20a%20memory%20access%20to%20be%20valid%2C%20the%20pointer%20and%20memory%20tags%20have%20to%20match.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20HWASan%20uses%20a%20lot%20less%20RAM%20compared%20to%20ASan%2C%20which%20makes%20it%20suitable%20for%20whole%20system%20sanitization.%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3EHere%20show%20an%20example%3A%20Use%20HWAsan%20for%20WiFi-HAL%20Memory%20Overflow%20issue%20hunting%20in%20Android-13.0.0_2.3.0_auto%20BSP.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Test%20environment%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BSW%3A%26nbsp%3B%26nbsp%3B%20Android-13.0.0_2.3.0_auto_car2%2C%20pre-built%20image.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%26nbsp%3BHW%3A%26nbsp%3B%2088W9098%20WiFi%2FBT%20EVK%20(PCIe)%20%2B%20i.MX8QXP%20EVK.%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Run%2088W9098%20WiFi%2FBT%20on%20i.MX8QXP%20EVK%2C%20after%20~2%20hours%2C%20got%20memory%20leakage.%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20To%20locate%20root%20cause%2C%20enabled%20HWASan%2C%20re-build%20Android-13.0.0_2.3.0_auto%20BSP%2C%20run%20again%2C%20Got%20HWAddressSanitizer%20report%3A%20%E2%80%9Cheap-buffer-overflow%E2%80%9D.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B--Reason%26gt%3B%26nbsp%3B%20%22Empty%20or%20null%20ScanResult%20list%22%26nbsp%3B%20-%26gt%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B--Then%26gt%3B%20%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%22Attempt%20to%20retrieve%20OsuProviders%20with%20invalid%20scanResult%20List%22%20-%26gt%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%26nbsp%3B--Result%26gt%3B%20%26nbsp%3B%20%26nbsp%3B%22heap-buffer-overflow%22%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20HWASan%20help%20to%20locate%20root%20cause%20of%20Memory%20Overflow%20issue%2C%20on%20WiFi%20AP%20Scan%20code.%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20Attach%20file%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%22Android_HW-assisted-Address-Sanitizer_for_memory-overflow_checking.pdf%22%3C%2FP%3E%3C%2FLINGO-BODY%3E
No ratings
Version history
Last update:
‎04-26-2024 01:12 AM
Updated by: