KASAN false negatives and false positives due to shadow byte validation, heap tagging, and longjmp handling
KASAN false negatives and false positives due to shadow byte validation, heap tagging, and longjmp handling: a task in LegoFlow-SWE (Harbor dataset). The KASAN implementation in OP‑TEE suffers from several correctness issues that cause it to silently miss invalid memory accesses (false negatives)…
The task
The KASAN implementation in OP‑TEE suffers from several correctness issues that cause it to silently miss invalid memory accesses (false negatives) or incorrectly flag valid code (false positives). Three distinct problems have been observed:
Part of Lego-X/LegoFlow-SWE.