os/mm: Added a quarantine mechanism to delay reuse of freed chunks for improved use after free detection . - #7478
Open
prathamrajbhatt-456 wants to merge 3 commits into
Open
Conversation
Fill the data area of a chunk with the 0xA5A5A5A5 poison pattern when it enters the free list, and verify the pattern before the chunk is consumed again. A mismatch means the chunk was written while it was free, which is a use-after-free by whoever owned it previously. The pattern is written from mm_addfreechunk(), which every chunk passes through on its way into the free list. Verification happens wherever a free chunk is consumed: - mm_malloc() and mm_memalign(), before the chunk is split - mm_free(), mm_realloc() and mm_shrinkchunk(), before a neighbouring free chunk is merged or absorbed. Checking here reports the corruption much earlier than waiting for the chunk to be handed out again. On detection the report prints the ERROR line, the node information via mm_dump_node(), and a hex dump of the whole chunk so that the corrupted words stand out against the 0xA5A5A5A5 background. Only the data area following the free node bookkeeping is covered. The allocator reuses the first SIZEOF_MM_FREENODE bytes for flink/blink and the free debug info while a chunk is free, so a write there corrupts the free list and is caught by DEBUGASSERT_MM_FREE_NODE instead. The covered size is capped by CONFIG_DEBUG_MM_UAF_POISON_SIZE to bound the cost added to every free and every allocation. New configuration options: - CONFIG_DEBUG_MM_UAF: enable the detector - CONFIG_DEBUG_MM_UAF_POISON_SIZE: bytes to poison per chunk, default 64 - CONFIG_DEBUG_MM_UAF_PANIC: assert on detection instead of only reporting [Example Log] ```bash mm_uaf_verify: ERROR: Use after free detected. mm_dump_node: FREE NODE: addr = 0x63a94030, type = F, size = 112, preceding size = 112 mm_dump_node: FREE NODE owner pid = 29 (hello), allocated by code at addr = 0x0e26d4fb Dump heap: 0x63a94030 - 0x63a940a0 63a94030: 00000070 0e26d4fb 0000001d 00000070 00000000 63a81088 0e26d785 0707001d 63a94050: deadbeef cafebabe 12345678 a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 63a94070: a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 a5a5a5a5 63a94090: 07070707 07070707 07070707 07070707 80000070 0e26d503 0000001d 00000070 ``` Co-Authored-By: Claude Signed-off-by: seokhun-eom <seokhun.eom@samsung.com>
prathamrajbhatt-456
changed the title
prathamrajbhatt-456
force-pushed
the
mmu_pr
branch
from
August 14, 2026 05:32
bfa6def to
e07287f
Compare
prathamrajbhatt-456
changed the title
|
|
||
| /* Check if this is a request to reduce the size of the allocation. */ | ||
|
|
||
| oldsize = oldnode->size; |
Contributor
There was a problem hiding this comment.
A chunk in quarantine still looks allocated, so realloc() on a freed pointer is accepted and grows it in place. The ring keeps the old size, so on release mm_qbytes underflows and memory that is in use again goes on the free list.
could you add the checking which mm_free() already has before this line at line no. 187?
#ifdef CONFIG_DEBUG_MM_QUARANTINE
if (mm_quarantine_contains(heap, oldnode)) {
mdbg("WARNING!! Realloc of a pointer still in quarantine\n");
mm_givesemaphore(heap);
return NULL;
}
#endif
This change is used in mm_free.c file.
Contributor
Author
There was a problem hiding this comment.
I have updated the code and verified on board also.
prathamrajbhatt-456
force-pushed
the
mmu_pr
branch
from
August 24, 2026 10:29
e07287f to
bea7a2b
Compare
…nd range-based API -It makes UAF reports safer by limiting hex dumps and fixing poison patterns.
…r improved UAF detection. Hold freed chunks in a separate list temporarily instead of free list and verify the poison pattern when chunk is released. This catches the multi-thread UAF bugs which the basic detector cannot see. New Configs: CONFIG_DEBUG_MM_QUARANTINE CONFIG_DEBUG_MM_QUARANTINE_CHUNKS CONFIG_DEBUG_MM_QUARANTINE_BYTES CONFIG_DEBUG_MM_QUARANTINE_MAX_SIZE
prathamrajbhatt-456
force-pushed
the
mmu_pr
branch
from
August 24, 2026 10:55
bea7a2b to
c4cca59
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is based on #7475 .
In this we have improved the UAF report by limiting the size of heap dump and fixing poison patterns.
Added a quarantine mechanism to delay reuse of freed chunks for improved use after free detection.
We have used a quarantine list of 32 nodes before making free nodes available for allocation.
This is able to detect test cases for use after free among multiple threads.
like for example -- Thread A frees the memory, Thread B allocates it for use, and Thread A uses it again.
New Configs:
CONFIG_DEBUG_MM_QUARANTINE
CONFIG_DEBUG_MM_QUARANTINE_CHUNKS
CONFIG_DEBUG_MM_QUARANTINE_BYTES
CONFIG_DEBUG_MM_QUARANTINE_MAX_SIZE