메모리 오버플로우·오염 진단 — Canary·MPU·Pattern 분석

1
[현장]  buf[1024]를 [1030]까지 씀   ← 누가
2
[증상]  buf 직후 stack의 LR이 깨짐 → return 시 hardfault   ← 어디서 보이는지

1
// stack canary 자동 삽입
2
void process(uint8_t *in, size_t n) {
3
    uint32_t __canary = __stack_chk_guard;
4
    uint8_t buf[64];
5
    memcpy(buf, in, n);   /* n > 64 → canary 깨짐 */
6
    if (__canary != __stack_chk_guard)
7
        __stack_chk_fail();
8
}

1
uint32_t __stack_chk_guard = 0xDEADBEEF;
2

3
void __stack_chk_fail(void) {
4
    printf("STACK SMASH\n");
5
    NVIC_SystemReset();
6
}

1
typedef struct {
2
    uint32_t magic_head;    /* 0xAB12CD34 */
3
    size_t   size;
4
    uint32_t pad[2];
5
} chunk_hdr_t;
6

7
void *my_malloc(size_t n) {
8
    chunk_hdr_t *c = real_malloc(sizeof(*c) + n + 4);
9
    c->magic_head = 0xAB12CD34;
10
    c->size       = n;
11
    *(uint32_t*)((uint8_t*)(c + 1) + n) = 0xCDEF1234;  /* tail */
12
    return c + 1;
13
}
14

15
int my_check(void *p) {
16
    chunk_hdr_t *c = (chunk_hdr_t*)p - 1;
17
    if (c->magic_head != 0xAB12CD34) return -1;
18
    if (*(uint32_t*)((uint8_t*)p + c->size) != 0xCDEF1234) return -1;
19
    return 0;
20
}

1
// task stack: 0x20001000 ~ 0x20002000
2
// guard:      0x20000FE0 ~ 0x20001000 (32 byte)
3

4
MPU->RNR = 0;
5
MPU->RBAR = 0x20000FE0;
6
MPU->RASR = (4 << MPU_RASR_SIZE_Pos)    /* 32 byte */
7
          | MPU_RASR_ENABLE_Msk
8
          | (0 << MPU_RASR_AP_Pos);     /* no access */

1
(gdb) watch *((uint32_t*)0x20001234)
2
(gdb) continue
3

4
Hardware watchpoint 2: *((uint32_t*)0x20001234)
5
Old value = 5
6
New value = 1819045216    ← 깨진 값
7
process_packet (data=0x...) at packet.c:78

1
/* DWT 직접 설정 (gdb 없이 production에서) */
2
DWT->COMP0  = 0x20001234;
3
DWT->MASK0  = 0;                          /* exact match */
4
DWT->FUNCTION0 = (5 << 0);               /* write 시 */
5

6
void DebugMon_Handler(void) {
7
    /* PC = DWT 매칭 직전의 명령 */
8
    handle_watch_hit();
9
}

1
==12345==ERROR: AddressSanitizer: heap-buffer-overflow
2
WRITE of size 4 at 0x602000000058 thread T0
3
    #0 0x4007ae in process_packet packet.c:84
4
    #1 0x4007fe in main main.c:23

1
extern uint32_t _estack;
2
extern uint32_t _Min_Stack_Size;
3

4
void stack_fill(void) {
5
    uint32_t *bottom = (uint32_t*)((char*)&_estack - (size_t)&_Min_Stack_Size);
6
    uint32_t *sp;
7
    __asm volatile ("mov %0, sp" : "=r"(sp));
8
    while (bottom < sp) *bottom++ = 0xA5A5A5A5;
9
}
10

11
size_t stack_used(void) {
12
    uint32_t *bottom = (uint32_t*)((char*)&_estack - (size_t)&_Min_Stack_Size);
13
    uint32_t *p = bottom;
14
    while (*p == 0xA5A5A5A5) p++;
15
    return (char*)&_estack - (char*)p;
16
}

1
volatile uint32_t SENTINEL_BEFORE = 0x11223344;
2
char comm_buffer[256];
3
volatile uint32_t SENTINEL_AFTER  = 0x55667788;
4

5
void check_sentinel(void) {
6
    if (SENTINEL_BEFORE != 0x11223344) printf("buf overflow before!\n");
7
    if (SENTINEL_AFTER  != 0x55667788) printf("buf overflow after!\n");
8
}

1
[증상] func_A → func_B → return → HardFault, PC = 0xdeadbeef
2
[가설] func_B 안에서 stack overflow로 saved LR이 깨짐

1
void func_B(uint8_t *in, size_t n) {
2
    char buf[32];
3
    strncpy(buf, in, n);   /* n = 100 → 68 byte overflow */
4
}

1
uint32_t g_state;   /* 갑자기 0xdeadbeef로 바뀜 */
2

3
/* watchpoint 시도 */
4
(gdb) watch g_state
5
(gdb) continue
6

7
Hardware watchpoint 1: g_state
8
Old value = 5
9
New value = 0xdeadbeef
10
dma_callback (ch=2) at dma.c:142

1
HardFault, BFAR = 0x00000004

1
MPU->RNR  = 7;
2
MPU->RBAR = 0x00000000;
3
MPU->RASR = (7 << MPU_RASR_SIZE_Pos)     /* 256 byte */
4
          | MPU_RASR_ENABLE_Msk
5
          | (0 << MPU_RASR_AP_Pos);

1
chunk_t *c = malloc_chunk();
2
free(c);
3
c->next = NULL;   /* ← 이미 free된 메모리 write */

1
void debug_free(void *p) {
2
    size_t n = chunk_size(p);
3
    memset(p, 0xDD, n);
4
    real_free(p);
5
}

1
dma_read_into(buf, 1024);
2
process(buf);   /* DDR write 완료, CPU cache는 옛 데이터 */

1
uint32_t *a = (uint32_t*)0x20001000;
2
uint8_t  *b = (uint8_t*)(a + 1);
3
*b = 5;
4
*(a + 1);   /* compiler가 a+1을 cache했으면 옛 값을 봄 */