fuzz: enable sys_heap ASan poisoning and per-sanitizer hardening split

tmleman · lgirdwood · commit 5ec09c69c34c · 2026-07-20T13:57:11.000+01:00
With CONFIG_SYS_HEAP_SANITIZER_ASAN enabled, freed and unallocated
sys_heap regions are explicitly marked unaddressable via ASan's manual
poisoning API. This gives ASan use-after-free and heap-buffer-overflow
detection on all SOF dynamic memory (not just libc allocations that
ASan tracks natively).

Since poisoning supersedes the full-heap walk for corruption detection
under ASan, downgrade the board-level default from EXTREME to FULL.
Canaries (FULL) remain valuable: they catch overflows into the adjacent
live chunk's trailer, a case that poisoning alone does not cover.

For UBSan builds, which have no heap awareness at all, keep EXTREME in
the sanitizer overlay so the full-walk remains the only proactive
corruption detector.

Signed-off-by: Tomasz Leman &lt;tomasz.m.leman@intel.com&gt;
diff --git a/app/boards/native_sim_libfuzzer.conf b/app/boards/native_sim_libfuzzer.conf
@@ -5,7 +5,7 @@ CONFIG_ASSERT=y
 CONFIG_EXCEPTION_DEBUG=y
 CONFIG_ARCH_POSIX_TRAP_ON_FATAL=y
 CONFIG_SYS_HEAP_BIG_ONLY=y
-CONFIG_SYS_HEAP_HARDENING_EXTREME=y
+CONFIG_SYS_HEAP_HARDENING_FULL=y
 CONFIG_STACK_SENTINEL=y
 CONFIG_ZEPHYR_NATIVE_DRIVERS=y
 CONFIG_ARCH_POSIX_LIBFUZZER=y
diff --git a/app/configs/fuzz_asan.conf b/app/configs/fuzz_asan.conf
@@ -1 +1,2 @@
 CONFIG_ASAN=y
+CONFIG_SYS_HEAP_SANITIZER_ASAN=y
diff --git a/app/configs/fuzz_ubsan.conf b/app/configs/fuzz_ubsan.conf
@@ -1 +1,2 @@
 CONFIG_UBSAN=y
+CONFIG_SYS_HEAP_HARDENING_EXTREME=y

Original file line number	Diff line number	Diff line change
`@@ -1 +1,2 @@`
`1`	`1`	`CONFIG_ASAN=y`
	`2`	`+CONFIG_SYS_HEAP_SANITIZER_ASAN=y`
Original file line number	Diff line number	Diff line change
`@@ -1 +1,2 @@`
`1`	`1`	`CONFIG_UBSAN=y`
	`2`	`+CONFIG_SYS_HEAP_HARDENING_EXTREME=y`