From 561cbb81b3bbae56a26e4875099b48ad15d66478 Mon Sep 17 00:00:00 2001 From: Tomasz Leman Date: Fri, 29 May 2026 17:05:24 +0200 Subject: [PATCH] fuzz: enable sys_heap ASan poisoning and per-sanitizer hardening split With CONFIG_SYS_HEAP_SANITIZER_ASAN enabled, freed and unallocated sys_heap regions are explicitly marked unaddressable via ASan's manual poisoning API. This gives ASan use-after-free and heap-buffer-overflow detection on all SOF dynamic memory (not just libc allocations that ASan tracks natively). Since poisoning supersedes the full-heap walk for corruption detection under ASan, downgrade the board-level default from EXTREME to FULL. Canaries (FULL) remain valuable: they catch overflows into the adjacent live chunk's trailer, a case that poisoning alone does not cover. For UBSan builds, which have no heap awareness at all, keep EXTREME in the sanitizer overlay so the full-walk remains the only proactive corruption detector. Signed-off-by: Tomasz Leman --- app/boards/native_sim_libfuzzer.conf | 2 +- app/configs/fuzz_asan.conf | 1 + app/configs/fuzz_ubsan.conf | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/app/boards/native_sim_libfuzzer.conf b/app/boards/native_sim_libfuzzer.conf index ba17224424cf..096bfe9dea47 100644 --- a/app/boards/native_sim_libfuzzer.conf +++ b/app/boards/native_sim_libfuzzer.conf @@ -5,7 +5,7 @@ CONFIG_ASSERT=y CONFIG_EXCEPTION_DEBUG=y CONFIG_ARCH_POSIX_TRAP_ON_FATAL=y CONFIG_SYS_HEAP_BIG_ONLY=y -CONFIG_SYS_HEAP_HARDENING_EXTREME=y +CONFIG_SYS_HEAP_HARDENING_FULL=y CONFIG_STACK_SENTINEL=y CONFIG_ZEPHYR_NATIVE_DRIVERS=y CONFIG_ARCH_POSIX_LIBFUZZER=y diff --git a/app/configs/fuzz_asan.conf b/app/configs/fuzz_asan.conf index a4b504ea7617..81b76171cd09 100644 --- a/app/configs/fuzz_asan.conf +++ b/app/configs/fuzz_asan.conf @@ -1 +1,2 @@ CONFIG_ASAN=y +CONFIG_SYS_HEAP_SANITIZER_ASAN=y diff --git a/app/configs/fuzz_ubsan.conf b/app/configs/fuzz_ubsan.conf index ceae016bdc4f..b21e104ef677 100644 --- a/app/configs/fuzz_ubsan.conf +++ b/app/configs/fuzz_ubsan.conf @@ -1 +1,2 @@ CONFIG_UBSAN=y +CONFIG_SYS_HEAP_HARDENING_EXTREME=y