Memory corruption
对于系统中出现随机、不可解释的异常指针访问或数据错误导致的异常，一般要考虑是内存使用上出现了 UAF（Use-After-Free），OOB（Out-of-Bounds）。
本章所指的"Memory corruption"特指 Linux kernel 侧出现的"Memory corruption"，子系统间的内存踩踏请参考 Firewall 。
通用方法
当怀疑系统有 OOB、UAF 类问题时，打开 CONFIG_KASAN 开关，进行复现。
当出现 memory corruption 问题时，系统默认会 BUG_ON。
检查 panic log 信息，对于 slub、stack、buddy page、全局变量的 UAF 和 OOB 均有关键信息指出，基本通过 log 能够解决所有问题。
典型问题
6.262525 BUG: KASAN: global-out-of-bounds in __of_match_node+0x70/0xb8
6.263391 Read of size 1 at addr ffffff9008d153a8 by task swapper/0/1
6.264231
6.264439 CPU: 5 PID: 1 Comm: swapper/0 Not tainted 6.1.94-rt33-gac7c113a9bab #2
6.265488 Hardware name: Horizon Robotics 征程 6E Evaluation Module Board （DT）
6.266362 Call trace:
6.266694 \[\] dump_backtrace+0x0/0x538
6.267391 \[\] show_stack+0x14/0x20
6.268048 \[\] dump_stack+0xa4/0xc8
6.268703 \[\] print_address_description+0x1e4/0x250
6.269539 \[\] kasan_report+0x2cc/0x300
6.270240 \[\] __asan_load1+0x44/0x50
6.270912 \[\] __of_match_node+0x70/0xb8
6.271617 \[\] of_match_node+0x38/0x60
6.272301 \[\] of_match_device+0x3c/0x50
6.273012 \[\] platform_match+0x64/0x118
6.273719 \[\] __driver_attach+0x40/0x140
6.274435 \[\] bus_for_each_dev+0xcc/0x140
6.275164 \[\] driver_attach+0x30/0x40
6.275848 \[\] bus_add_driver+0x220/0x388
6.276566 \[\] driver_register+0x108/0x170
6.277295 \[\] __platform_driver_register+0x7c/0x88
6.278122 \[\] 征程 6_wdt_driver_init+0x34/0x4c
6.278861 \[\] do_one_initcall+0xe4/0x1b8
6.279581 \[\] kernel_init_freeable+0x1ac/0x260
6.280363 \[\] kernel_init+0x10/0x118
6.281036 \[\] ret_from_fork+0x10/0x18
6.281713
6.281911 The buggy address belongs to the variable:
6.282570 0xffffff9008d153a8
6.282974
6.283173 Memory state around the buggy address:
6.283794 ffffff9008d15280: fa fa fa fa 07 fa fa fa fa fa fa fa 00 00 00 00
6.284715 ffffff9008d15300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6.285636 >ffffff9008d15380: 00 00 00 00 00 fa fa fa fa fa fa fa 00 00 00 00
6.286552 ^
6.287137 ffffff9008d15400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6.288057 ffffff9008d15480: 00 00 00 fa fa fa fa fa 00 00 fa fa fa fa fa fa
6.288974 ==================================================================
6.289890 Disabling lock debugging due to kernel taint
错误类型 global-out-of-bounds，全局变量越界访问，越界读取访问一个字节。
检查 Calltrace 是在驱动 probe 匹配 device、driver 的过程中。
复杂问题可能需要检查 trace 后面 buggy address（并非实际数据地址，而是在 shadow 区的映射）信息综合分析，此问题可以看到要访问地址 ffffff9008d153a8 里数据为 0xFA，0xFA 代表全局变量的 redzone（越界检测）。
检查逻辑__of_match_node 过程是循环遍历 of_match_table 中所有的项，直到表项中成员为空退出循环。
const struct of_device_id *__of_match_node(const struct of_device_id *matches,
const struct device_node *node)
{
const struct of_device_id *best_match = NULL;
int score, best_score = 0;
if (!matches)
return NULL;
for (; matches->name0 |matches->type0 |matches->compatible0; matches++) {
score = __of_device_is_compatible(node, matches->compatible,
matches->type, matches->name);
if (score > best_score) {
best_match = matches;
best_score = score;
}
}
return best_match;
}
根据代码可知，越界原因是 of_match_table 变量尾部没有填充 0。
#ifdef CONFIG_OF
static const struct of_device_id 征程 6_wdt_of_match\[\] = {
- { .compatible = "snps，征程 6_wdt"， }
- /* sentinel */
- { .compatible = "snps，征程 6_wdt"， }，
- {/* sentinel /} / PRQA S 1041 */ };MODULE_D