Re: Problem with Kernel Address Sanitizer and data on stack

Am 31.12.25 um 19:05 schrieb Andrey Tarasevich:
> If I recall correctly, the stack address sanitizer works by properly poisoning the shadow
> in function prologue and then properly _unpoisoning_ it (i.e. zeroing it out) in the function
> epilogue. I.e. the AS operates under assumption that on function entry the corresponding shadow
> is already pre-zeroed. This is why your second version does not make any effort to do anything
> about that nice and even 32-byte block on entry.

Ok, I see the unpoisoning in the function epilogue now. For the 31-byte 
version of the test the there's explicit unpoisoning for the 
corresponding four bytes of the shadow memory, while for the 32-byte 
version this is missing, because in that case it was not partly poisoned 
on entry.

> If you encounter AS false positives in your case, it is probably not a problem with the
> poisoning (prologue) code you quoted, but rather a problem with some other epilogue code
> that operated on the same shadow previously. That previous code failed to zero out shadow
> memory that was supposed to be zeroed out.

I think it is not another epilogue code. The startup code before main() 
apparently must initialize the shadow memory for the whole stack segment 
with zeroes to unpoison it. This is currently not implemented.

Thanks for explaining the requirement to pre-zero the shadow memory for 
the stack. This all makes more sense now. I will implement this and very 
likely this will fix the problem.

Stephan