自 2025 年 3 月 27 日起，我们建议您使用 android-latest-release 而非 aosp-main 构建 AOSP 并为其做出贡献。如需了解详情，请参阅 AOSP 的变更。
内核地址排错程序
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
与针对用户空间组件的基于 LLVM 的排错程序一样，Android 包括内核地址排错程序 (KASan)。KASan 是内核与编译时修改的组合，形成了一个插桩系统，可以实现更简单的 bug 发现和根本原因分析。
KASan 可以检测内核中许多类型的内存违规行为。它还可以检测堆栈、堆和全局变量中的出界读取和写入操作，并可检测释放后再使用和双重释放错误。
与 ASan 一样，KASan 将编译时内存函数插桩与影子内存相结合，以便跟踪运行时的内存访问。在 KASan 中，八分之一的内核内存空间专用于影子内存，以确定内存访问是否有效。
KASan 在 x86_64 和 arm64 架构中受支持。自 4.0 以来，它一直是上游内核的一部分，并且已经反向移植到基于 Android 3.18 的内核。
除了 KASan，kcov 是另一个对测试非常有用的内核修改。kcov 旨在允许在内核中进行覆盖率引导模糊测试。它会测量在系统调用输入方面的覆盖率，对于模糊系统（如 syzkaller）非常有用。
实现
如需在启用 KASan 和 kcov 的情况下编译内核，请将以下 build 标志添加到内核 build 配置：
CONFIG_KASAN
CONFIG_KASAN_INLINE
CONFIG_TEST_KASAN
CONFIG_KCOV
CONFIG_SLUB
CONFIG_SLUB_DEBUG
CONFIG_CC_OPTIMIZE_FOR_SIZE
并移除以下内容：
CONFIG_SLUB_DEBUG_ON
CONFIG_SLUB_DEBUG_PANIC_ON
CONFIG_KASAN_OUTLINE
CONFIG_KERNEL_LZ4
然后照常构建和刷写内核。KASan 内核比原始内核大得多。考虑到这一点，请根据需要修改任何启动参数和引导加载程序设置。
刷写内核后，检查内核启动日志，看看 KASan 是否已启用并正在运行。内核将启动并显示 KASan 的内存映射信息，例如：
...
[ 0.000000] c0 0 Virtual kernel memory layout:
[ 0.000000] c0 0 kasan : 0xffffff8000000000 - 0xffffff9000000000 ( 64 GB)
[ 0.000000] c0 0 vmalloc : 0xffffff9000010000 - 0xffffffbdbfff0000 ( 182 GB)
[ 0.000000] c0 0 vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)
[ 0.000000] c0 0 0xffffffbdc0000000 - 0xffffffbdc3f95400 ( 63 MB actual)
[ 0.000000] c0 0 PCI I/O : 0xffffffbffa000000 - 0xffffffbffb000000 ( 16 MB)
[ 0.000000] c0 0 fixed : 0xffffffbffbdfd000 - 0xffffffbffbdff000 ( 8 KB)
[ 0.000000] c0 0 modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB)
[ 0.000000] c0 0 memory : 0xffffffc000000000 - 0xffffffc0fe550000 ( 4069 MB)
[ 0.000000] c0 0 .init : 0xffffffc001d33000 - 0xffffffc001dce000 ( 620 KB)
[ 0.000000] c0 0 .text : 0xffffffc000080000 - 0xffffffc001d32284 ( 29385 KB)
...
错误将如下所示：
[ 18.539668] c3 1 ==================================================================
[ 18.547662] c3 1 BUG: KASAN: null-ptr-deref on address 0000000000000008
[ 18.554689] c3 1 Read of size 8 by task swapper/0/1
[ 18.559988] c3 1 CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 3.18.24-xxx #1
[ 18.569275] c3 1 Hardware name: Android Device
[ 18.577433] c3 1 Call trace:
[ 18.580739] c3 1 [<ffffffc00008b32c>] dump_backtrace+0x0/0x2c4
[ 18.586985] c3 1 [<ffffffc00008b600>] show_stack+0x10/0x1c
[ 18.592889] c3 1 [<ffffffc001481194>] dump_stack+0x74/0xc8
[ 18.598792] c3 1 [<ffffffc000202ee0>] kasan_report+0x11c/0x4d0
[ 18.605038] c3 1 [<ffffffc00020286c>] __asan_load8+0x20/0x80
[ 18.611115] c3 1 [<ffffffc000bdefe8>] android_verity_ctr+0x8cc/0x1024
[ 18.617976] c3 1 [<ffffffc000bcaa2c>] dm_table_add_target+0x3dc/0x50c
[ 18.624832] c3 1 [<ffffffc001bdbe60>] dm_run_setup+0x50c/0x678
[ 18.631082] c3 1 [<ffffffc001bda8c0>] prepare_namespace+0x44/0x1ac
[ 18.637676] c3 1 [<ffffffc001bda170>] kernel_init_freeable+0x328/0x364
[ 18.644625] c3 1 [<ffffffc001478e20>] kernel_init+0x10/0xd8
[ 18.650613] c3 1 ==================================================================
此外，如果在内核中启用了模块，则可以加载 test_kasan 内核模块以供进一步测试。该模块会尝试“越界内存访问”和“释放后再使用”，有助于确保你在目标设备上正确启用 KASAN。
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-27。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# Kernel Address Sanitizer\n\nSimilar to the LLVM-based sanitizers for userspace components, Android includes\nthe Kernel Address Sanitizer (KASan). KASan is a combination of kernel and\ncompile time modifications that result in an instrumented system that allows for\nsimpler bug discovery and root cause analysis.\n\n\nKASan can detect many types of memory violations in the kernel. It can also\ndetect out-of-bound reads and writes on stack, heap and global variables, and\ncan detect use-after-free and double frees.\n\n\nSimilar to ASan, KASan uses a combination of memory-function instrumentation at\ncompile time and shadow memory to track memory accesses at runtime. In KASan, an\neighth of the kernel memory space is dedicated to shadow memory, which\ndetermines if a memory access is valid or not.\n\n\nKASan is supported on x86_64 and arm64 architectures. It has been part of the\nupstream kernel since 4.0, and has been backported to Android 3.18-based\nkernels.\n\n\nIn addition to KASan, kcov is another kernel modification that is useful for\ntesting. kcov was developed to allow for coverage-guided fuzz testing in the\nkernel. It measures coverage in terms of syscall inputs and is useful with\nfuzzing systems, such as [syzkaller](https://github.com/google/syzkaller).\n\nImplementation\n--------------\n\n\nTo compile a kernel with KASan and kcov enabled, add the following build flags\nto your kernel build configuration: \n\n```\nCONFIG_KASAN\nCONFIG_KASAN_INLINE\nCONFIG_TEST_KASAN\nCONFIG_KCOV\nCONFIG_SLUB\nCONFIG_SLUB_DEBUG\nCONFIG_CC_OPTIMIZE_FOR_SIZE\n```\n\n\nAnd removing the following: \n\n```\nCONFIG_SLUB_DEBUG_ON\nCONFIG_SLUB_DEBUG_PANIC_ON\nCONFIG_KASAN_OUTLINE\nCONFIG_KERNEL_LZ4\n```\n\n\nThen build and flash your kernel as usual. The KASan kernel is considerably\nlarger than the original. If needed, modify any boot parameters and\nbootloader settings to take this into consideration.\n\n\nAfter flashing the kernel, check the kernel boot logs to see if KASan is enabled\nand running. The kernel will start up with memory map information for KASan,\nsuch as: \n\n```\n...\n[ 0.000000] c0 0 Virtual kernel memory layout:\n[ 0.000000] c0 0 kasan : 0xffffff8000000000 - 0xffffff9000000000 ( 64 GB)\n[ 0.000000] c0 0 vmalloc : 0xffffff9000010000 - 0xffffffbdbfff0000 ( 182 GB)\n[ 0.000000] c0 0 vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)\n[ 0.000000] c0 0 0xffffffbdc0000000 - 0xffffffbdc3f95400 ( 63 MB actual)\n[ 0.000000] c0 0 PCI I/O : 0xffffffbffa000000 - 0xffffffbffb000000 ( 16 MB)\n[ 0.000000] c0 0 fixed : 0xffffffbffbdfd000 - 0xffffffbffbdff000 ( 8 KB)\n[ 0.000000] c0 0 modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB)\n[ 0.000000] c0 0 memory : 0xffffffc000000000 - 0xffffffc0fe550000 ( 4069 MB)\n[ 0.000000] c0 0 .init : 0xffffffc001d33000 - 0xffffffc001dce000 ( 620 KB)\n[ 0.000000] c0 0 .text : 0xffffffc000080000 - 0xffffffc001d32284 ( 29385 KB)\n...\n```\n\n\nAnd this is how a bug will look: \n\n```\n[ 18.539668] c3 1 ==================================================================\n[ 18.547662] c3 1 BUG: KASAN: null-ptr-deref on address 0000000000000008\n[ 18.554689] c3 1 Read of size 8 by task swapper/0/1\n[ 18.559988] c3 1 CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 3.18.24-xxx #1\n[ 18.569275] c3 1 Hardware name: Android Device\n[ 18.577433] c3 1 Call trace:\n[ 18.580739] c3 1 [\u003cffffffc00008b32c\u003e] dump_backtrace+0x0/0x2c4\n[ 18.586985] c3 1 [\u003cffffffc00008b600\u003e] show_stack+0x10/0x1c\n[ 18.592889] c3 1 [\u003cffffffc001481194\u003e] dump_stack+0x74/0xc8\n[ 18.598792] c3 1 [\u003cffffffc000202ee0\u003e] kasan_report+0x11c/0x4d0\n[ 18.605038] c3 1 [\u003cffffffc00020286c\u003e] __asan_load8+0x20/0x80\n[ 18.611115] c3 1 [\u003cffffffc000bdefe8\u003e] android_verity_ctr+0x8cc/0x1024\n[ 18.617976] c3 1 [\u003cffffffc000bcaa2c\u003e] dm_table_add_target+0x3dc/0x50c\n[ 18.624832] c3 1 [\u003cffffffc001bdbe60\u003e] dm_run_setup+0x50c/0x678\n[ 18.631082] c3 1 [\u003cffffffc001bda8c0\u003e] prepare_namespace+0x44/0x1ac\n[ 18.637676] c3 1 [\u003cffffffc001bda170\u003e] kernel_init_freeable+0x328/0x364\n[ 18.644625] c3 1 [\u003cffffffc001478e20\u003e] kernel_init+0x10/0xd8\n[ 18.650613] c3 1 ==================================================================\n```\n\n\nIn addition, if modules are enabled in your kernel, you can load the test_kasan\nkernel module for further testing. The module attempts out-of-bounds memory\naccesses and use-after-free and is useful for ensuring you correctly enabled KASan\non a target device."]]
