yushuailong opened a new pull request, #18966:
URL: https://github.com/apache/nuttx/pull/18966
## Summary
When CONFIG_MM_UMM_CUSTOMIZE_MANAGER is enabled, the sim heap bypasses
mm_heap/tlsf entirely and calls host malloc/free directly, so
MM_FILL_ALLOCATIONS has no effect. Add fill pattern support directly in
sim_ummheap.c:
- malloc: fill user region with 0xaa
- free: fill user region with 0x55
- realloc: fill extended region with 0xaa
This helps detect uninitialized reads in sim environment, which ASan does
not support.
## Impact
Only affects sim arch when both CONFIG_MM_UMM_CUSTOMIZE_MANAGER and
CONFIG_MM_FILL_ALLOCATIONS are enabled.
## Testing
Host: Linux x86_64 (Ubuntu)
Board: sim (simulator)
Config: sim:ostest with CONFIG_MM_UMM_CUSTOMIZE_MANAGER=y and
CONFIG_MM_FILL_ALLOCATIONS=y
Toolchain: GCC
Test case :
```c
#define TEST_SIZE 64
#define REALLOC_SIZE 128
#define MAGIC_ALLOC 0xaa
#define MAGIC_FREE 0x55
/* Test 1: malloc fills user region with 0xaa */
static void test_malloc_fill(void)
{
unsigned char *p = malloc(TEST_SIZE);
assert(check_pattern(p, MAGIC_ALLOC, TEST_SIZE) == 0);
free(p);
}
/* Test 2: free fills user region with 0x55 */
static void test_free_fill(void)
{
unsigned char *p = malloc(TEST_SIZE);
unsigned char *saved = p;
memset(p, 0x12, TEST_SIZE);
free(p);
assert(check_pattern(saved, MAGIC_FREE, TEST_SIZE) == 0);
}
/* Test 3: realloc extend fills grown region with 0xaa */
static void test_realloc_extend_fill(void)
{
unsigned char *p = malloc(TEST_SIZE);
memset(p, 0x12, TEST_SIZE);
p = realloc(p, REALLOC_SIZE);
assert(check_pattern(p, 0x12, TEST_SIZE) == 0); /* old data
preserved */
assert(check_pattern(p + TEST_SIZE, MAGIC_ALLOC,
REALLOC_SIZE - TEST_SIZE) == 0); /* extended
region filled */
free(p);
}
/* Test 4: realloc shrink preserves data */
static void test_realloc_shrink_no_corrupt(void)
{
unsigned char *p = malloc(REALLOC_SIZE);
memset(p, 0x34, REALLOC_SIZE);
p = realloc(p, TEST_SIZE);
assert(check_pattern(p, 0x34, TEST_SIZE) == 0);
free(p);
}
int main(int argc, FAR char *argv[])
{
printf("\n=== MM_FILL_ALLOCATIONS Test ===\n\n");
test_malloc_fill();
test_free_fill();
test_realloc_extend_fill();
test_realloc_shrink_no_corrupt();
printf("\n=== Test Complete ===\n");
return 0;
}
```
Test log:
=== MM_FILL_ALLOCATIONS Test ===
TEST: malloc fill 0xaa ... PASS
TEST: free fill 0x55 ... PASS
TEST: realloc extend fill 0xaa ... PASS
TEST: realloc shrink preserves data ... PASS
=== Test Complete ===
All 4 tests pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
