自 2025 年 3 月 27 日起，我們建議您使用 android-latest-release 而非 aosp-main 建構及貢獻 AOSP。詳情請參閱「Android 開放原始碼計畫變更」。
核心 Address Sanitizer
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
與以 LLVM 為基礎的使用者空間元件消毒工具相似，Android 也包含 Kernel Address Sanitizer (KASan)。KASan 結合了核心和編譯時間修改項目，產生可檢測錯誤和進行根本原因分析的檢測系統。
KASan 可偵測核心中的多種記憶體違規情形。它還可偵測堆疊、堆積和全域變數的超出邊界讀取和寫入作業，並可偵測釋放後使用和雙重釋放。
與 ASan 類似，KASan 會在編譯時結合記憶體函式檢測功能和影子記憶體，以便在執行階段追蹤記憶體存取作業。在 KASan 中，核心記憶體空間的八分之一專用於陰影記憶體，用於判斷記憶體存取是否有效。
x86_64 和 arm64 架構支援 KASan。自 4.0 以來，它一直是上游核心的一部分，並已向後移植至以 Android 3.18 為基礎的核心。
除了 KASan，kcov 也是另一個可用於測試的核心修改項目。kcov 的開發目的是在核心中進行涵蓋率導向的模糊測試。它會根據系統呼叫輸入內容來評估涵蓋率，並可與 syzkaller 等模糊測試系統搭配使用。
實作
如要編譯啟用 KASan 和 kcov 的核心，請在核心建構設定中新增下列建構標記：
CONFIG_KASAN
CONFIG_KASAN_INLINE
CONFIG_TEST_KASAN
CONFIG_KCOV
CONFIG_SLUB
CONFIG_SLUB_DEBUG
CONFIG_CC_OPTIMIZE_FOR_SIZE
並移除下列項目：
CONFIG_SLUB_DEBUG_ON
CONFIG_SLUB_DEBUG_PANIC_ON
CONFIG_KASAN_OUTLINE
CONFIG_KERNEL_LZ4
然後照常建構及閃過核心。KASan 核心比原始核心大得多。如有需要，請修改任何啟動參數和啟動載入器設定，以便考量這項因素。
閃燈更新核心後，請檢查核心啟動記錄，查看是否已啟用並執行 KASan。核心會啟動 KASan 的記憶體對應資訊，例如：
...
[ 0.000000] c0 0 Virtual kernel memory layout:
[ 0.000000] c0 0 kasan : 0xffffff8000000000 - 0xffffff9000000000 ( 64 GB)
[ 0.000000] c0 0 vmalloc : 0xffffff9000010000 - 0xffffffbdbfff0000 ( 182 GB)
[ 0.000000] c0 0 vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)
[ 0.000000] c0 0 0xffffffbdc0000000 - 0xffffffbdc3f95400 ( 63 MB actual)
[ 0.000000] c0 0 PCI I/O : 0xffffffbffa000000 - 0xffffffbffb000000 ( 16 MB)
[ 0.000000] c0 0 fixed : 0xffffffbffbdfd000 - 0xffffffbffbdff000 ( 8 KB)
[ 0.000000] c0 0 modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB)
[ 0.000000] c0 0 memory : 0xffffffc000000000 - 0xffffffc0fe550000 ( 4069 MB)
[ 0.000000] c0 0 .init : 0xffffffc001d33000 - 0xffffffc001dce000 ( 620 KB)
[ 0.000000] c0 0 .text : 0xffffffc000080000 - 0xffffffc001d32284 ( 29385 KB)
...
以下是錯誤的樣子：
[ 18.539668] c3 1 ==================================================================
[ 18.547662] c3 1 BUG: KASAN: null-ptr-deref on address 0000000000000008
[ 18.554689] c3 1 Read of size 8 by task swapper/0/1
[ 18.559988] c3 1 CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 3.18.24-xxx #1
[ 18.569275] c3 1 Hardware name: Android Device
[ 18.577433] c3 1 Call trace:
[ 18.580739] c3 1 [<ffffffc00008b32c>] dump_backtrace+0x0/0x2c4
[ 18.586985] c3 1 [<ffffffc00008b600>] show_stack+0x10/0x1c
[ 18.592889] c3 1 [<ffffffc001481194>] dump_stack+0x74/0xc8
[ 18.598792] c3 1 [<ffffffc000202ee0>] kasan_report+0x11c/0x4d0
[ 18.605038] c3 1 [<ffffffc00020286c>] __asan_load8+0x20/0x80
[ 18.611115] c3 1 [<ffffffc000bdefe8>] android_verity_ctr+0x8cc/0x1024
[ 18.617976] c3 1 [<ffffffc000bcaa2c>] dm_table_add_target+0x3dc/0x50c
[ 18.624832] c3 1 [<ffffffc001bdbe60>] dm_run_setup+0x50c/0x678
[ 18.631082] c3 1 [<ffffffc001bda8c0>] prepare_namespace+0x44/0x1ac
[ 18.637676] c3 1 [<ffffffc001bda170>] kernel_init_freeable+0x328/0x364
[ 18.644625] c3 1 [<ffffffc001478e20>] kernel_init+0x10/0xd8
[ 18.650613] c3 1 ==================================================================
此外，如果在核心中啟用模組，您可以載入 test_kasan 核心模組以進行進一步測試。此模組會嘗試超出邊界記憶體存取和釋放後使用，有助於確保您在目標裝置上正確啟用 KASan。
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2025-07-27 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-27 (世界標準時間)。"],[],[],null,["# Kernel Address Sanitizer\n\nSimilar to the LLVM-based sanitizers for userspace components, Android includes\nthe Kernel Address Sanitizer (KASan). KASan is a combination of kernel and\ncompile time modifications that result in an instrumented system that allows for\nsimpler bug discovery and root cause analysis.\n\n\nKASan can detect many types of memory violations in the kernel. It can also\ndetect out-of-bound reads and writes on stack, heap and global variables, and\ncan detect use-after-free and double frees.\n\n\nSimilar to ASan, KASan uses a combination of memory-function instrumentation at\ncompile time and shadow memory to track memory accesses at runtime. In KASan, an\neighth of the kernel memory space is dedicated to shadow memory, which\ndetermines if a memory access is valid or not.\n\n\nKASan is supported on x86_64 and arm64 architectures. It has been part of the\nupstream kernel since 4.0, and has been backported to Android 3.18-based\nkernels.\n\n\nIn addition to KASan, kcov is another kernel modification that is useful for\ntesting. kcov was developed to allow for coverage-guided fuzz testing in the\nkernel. It measures coverage in terms of syscall inputs and is useful with\nfuzzing systems, such as [syzkaller](https://github.com/google/syzkaller).\n\nImplementation\n--------------\n\n\nTo compile a kernel with KASan and kcov enabled, add the following build flags\nto your kernel build configuration: \n\n```\nCONFIG_KASAN\nCONFIG_KASAN_INLINE\nCONFIG_TEST_KASAN\nCONFIG_KCOV\nCONFIG_SLUB\nCONFIG_SLUB_DEBUG\nCONFIG_CC_OPTIMIZE_FOR_SIZE\n```\n\n\nAnd removing the following: \n\n```\nCONFIG_SLUB_DEBUG_ON\nCONFIG_SLUB_DEBUG_PANIC_ON\nCONFIG_KASAN_OUTLINE\nCONFIG_KERNEL_LZ4\n```\n\n\nThen build and flash your kernel as usual. The KASan kernel is considerably\nlarger than the original. If needed, modify any boot parameters and\nbootloader settings to take this into consideration.\n\n\nAfter flashing the kernel, check the kernel boot logs to see if KASan is enabled\nand running. The kernel will start up with memory map information for KASan,\nsuch as: \n\n```\n...\n[ 0.000000] c0 0 Virtual kernel memory layout:\n[ 0.000000] c0 0 kasan : 0xffffff8000000000 - 0xffffff9000000000 ( 64 GB)\n[ 0.000000] c0 0 vmalloc : 0xffffff9000010000 - 0xffffffbdbfff0000 ( 182 GB)\n[ 0.000000] c0 0 vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)\n[ 0.000000] c0 0 0xffffffbdc0000000 - 0xffffffbdc3f95400 ( 63 MB actual)\n[ 0.000000] c0 0 PCI I/O : 0xffffffbffa000000 - 0xffffffbffb000000 ( 16 MB)\n[ 0.000000] c0 0 fixed : 0xffffffbffbdfd000 - 0xffffffbffbdff000 ( 8 KB)\n[ 0.000000] c0 0 modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB)\n[ 0.000000] c0 0 memory : 0xffffffc000000000 - 0xffffffc0fe550000 ( 4069 MB)\n[ 0.000000] c0 0 .init : 0xffffffc001d33000 - 0xffffffc001dce000 ( 620 KB)\n[ 0.000000] c0 0 .text : 0xffffffc000080000 - 0xffffffc001d32284 ( 29385 KB)\n...\n```\n\n\nAnd this is how a bug will look: \n\n```\n[ 18.539668] c3 1 ==================================================================\n[ 18.547662] c3 1 BUG: KASAN: null-ptr-deref on address 0000000000000008\n[ 18.554689] c3 1 Read of size 8 by task swapper/0/1\n[ 18.559988] c3 1 CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 3.18.24-xxx #1\n[ 18.569275] c3 1 Hardware name: Android Device\n[ 18.577433] c3 1 Call trace:\n[ 18.580739] c3 1 [\u003cffffffc00008b32c\u003e] dump_backtrace+0x0/0x2c4\n[ 18.586985] c3 1 [\u003cffffffc00008b600\u003e] show_stack+0x10/0x1c\n[ 18.592889] c3 1 [\u003cffffffc001481194\u003e] dump_stack+0x74/0xc8\n[ 18.598792] c3 1 [\u003cffffffc000202ee0\u003e] kasan_report+0x11c/0x4d0\n[ 18.605038] c3 1 [\u003cffffffc00020286c\u003e] __asan_load8+0x20/0x80\n[ 18.611115] c3 1 [\u003cffffffc000bdefe8\u003e] android_verity_ctr+0x8cc/0x1024\n[ 18.617976] c3 1 [\u003cffffffc000bcaa2c\u003e] dm_table_add_target+0x3dc/0x50c\n[ 18.624832] c3 1 [\u003cffffffc001bdbe60\u003e] dm_run_setup+0x50c/0x678\n[ 18.631082] c3 1 [\u003cffffffc001bda8c0\u003e] prepare_namespace+0x44/0x1ac\n[ 18.637676] c3 1 [\u003cffffffc001bda170\u003e] kernel_init_freeable+0x328/0x364\n[ 18.644625] c3 1 [\u003cffffffc001478e20\u003e] kernel_init+0x10/0xd8\n[ 18.650613] c3 1 ==================================================================\n```\n\n\nIn addition, if modules are enabled in your kernel, you can load the test_kasan\nkernel module for further testing. The module attempts out-of-bounds memory\naccesses and use-after-free and is useful for ensuring you correctly enabled KASan\non a target device."]]
