Commit | Line | Data |
---|---|---|
0b24becc AR |
1 | /* |
2 | * This file contains shadow memory manipulation code. | |
3 | * | |
4 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. | |
2baf9e89 | 5 | * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> |
0b24becc AR |
6 | * |
7 | * Some of code borrowed from https://github.com/xairy/linux by | |
8 | * Andrey Konovalov <adech.fo@gmail.com> | |
9 | * | |
10 | * This program is free software; you can redistribute it and/or modify | |
11 | * it under the terms of the GNU General Public License version 2 as | |
12 | * published by the Free Software Foundation. | |
13 | * | |
14 | */ | |
15 | ||
16 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
17 | #define DISABLE_BRANCH_PROFILING | |
18 | ||
19 | #include <linux/export.h> | |
20 | #include <linux/init.h> | |
21 | #include <linux/kernel.h> | |
22 | #include <linux/memblock.h> | |
786a8959 | 23 | #include <linux/memory.h> |
0b24becc | 24 | #include <linux/mm.h> |
bebf56a1 | 25 | #include <linux/module.h> |
0b24becc AR |
26 | #include <linux/printk.h> |
27 | #include <linux/sched.h> | |
28 | #include <linux/slab.h> | |
29 | #include <linux/stacktrace.h> | |
30 | #include <linux/string.h> | |
31 | #include <linux/types.h> | |
a5af5aa8 | 32 | #include <linux/vmalloc.h> |
0b24becc AR |
33 | #include <linux/kasan.h> |
34 | ||
35 | #include "kasan.h" | |
0316bec2 | 36 | #include "../slab.h" |
0b24becc AR |
37 | |
38 | /* | |
39 | * Poisons the shadow memory for 'size' bytes starting from 'addr'. | |
40 | * Memory addresses should be aligned to KASAN_SHADOW_SCALE_SIZE. | |
41 | */ | |
42 | static void kasan_poison_shadow(const void *address, size_t size, u8 value) | |
43 | { | |
44 | void *shadow_start, *shadow_end; | |
45 | ||
46 | shadow_start = kasan_mem_to_shadow(address); | |
47 | shadow_end = kasan_mem_to_shadow(address + size); | |
48 | ||
49 | memset(shadow_start, value, shadow_end - shadow_start); | |
50 | } | |
51 | ||
52 | void kasan_unpoison_shadow(const void *address, size_t size) | |
53 | { | |
54 | kasan_poison_shadow(address, size, 0); | |
55 | ||
56 | if (size & KASAN_SHADOW_MASK) { | |
57 | u8 *shadow = (u8 *)kasan_mem_to_shadow(address + size); | |
58 | *shadow = size & KASAN_SHADOW_MASK; | |
59 | } | |
60 | } | |
61 | ||
62 | ||
63 | /* | |
64 | * All functions below always inlined so compiler could | |
65 | * perform better optimizations in each of __asan_loadX/__assn_storeX | |
66 | * depending on memory access size X. | |
67 | */ | |
68 | ||
69 | static __always_inline bool memory_is_poisoned_1(unsigned long addr) | |
70 | { | |
71 | s8 shadow_value = *(s8 *)kasan_mem_to_shadow((void *)addr); | |
72 | ||
73 | if (unlikely(shadow_value)) { | |
74 | s8 last_accessible_byte = addr & KASAN_SHADOW_MASK; | |
75 | return unlikely(last_accessible_byte >= shadow_value); | |
76 | } | |
77 | ||
78 | return false; | |
79 | } | |
80 | ||
81 | static __always_inline bool memory_is_poisoned_2(unsigned long addr) | |
82 | { | |
83 | u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr); | |
84 | ||
85 | if (unlikely(*shadow_addr)) { | |
86 | if (memory_is_poisoned_1(addr + 1)) | |
87 | return true; | |
88 | ||
89 | if (likely(((addr + 1) & KASAN_SHADOW_MASK) != 0)) | |
90 | return false; | |
91 | ||
92 | return unlikely(*(u8 *)shadow_addr); | |
93 | } | |
94 | ||
95 | return false; | |
96 | } | |
97 | ||
98 | static __always_inline bool memory_is_poisoned_4(unsigned long addr) | |
99 | { | |
100 | u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr); | |
101 | ||
102 | if (unlikely(*shadow_addr)) { | |
103 | if (memory_is_poisoned_1(addr + 3)) | |
104 | return true; | |
105 | ||
106 | if (likely(((addr + 3) & KASAN_SHADOW_MASK) >= 3)) | |
107 | return false; | |
108 | ||
109 | return unlikely(*(u8 *)shadow_addr); | |
110 | } | |
111 | ||
112 | return false; | |
113 | } | |
114 | ||
115 | static __always_inline bool memory_is_poisoned_8(unsigned long addr) | |
116 | { | |
117 | u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr); | |
118 | ||
119 | if (unlikely(*shadow_addr)) { | |
120 | if (memory_is_poisoned_1(addr + 7)) | |
121 | return true; | |
122 | ||
123 | if (likely(((addr + 7) & KASAN_SHADOW_MASK) >= 7)) | |
124 | return false; | |
125 | ||
126 | return unlikely(*(u8 *)shadow_addr); | |
127 | } | |
128 | ||
129 | return false; | |
130 | } | |
131 | ||
132 | static __always_inline bool memory_is_poisoned_16(unsigned long addr) | |
133 | { | |
134 | u32 *shadow_addr = (u32 *)kasan_mem_to_shadow((void *)addr); | |
135 | ||
136 | if (unlikely(*shadow_addr)) { | |
137 | u16 shadow_first_bytes = *(u16 *)shadow_addr; | |
0b24becc AR |
138 | |
139 | if (unlikely(shadow_first_bytes)) | |
140 | return true; | |
141 | ||
8d77a6d1 | 142 | if (likely(IS_ALIGNED(addr, 8))) |
0b24becc AR |
143 | return false; |
144 | ||
145 | return memory_is_poisoned_1(addr + 15); | |
146 | } | |
147 | ||
148 | return false; | |
149 | } | |
150 | ||
151 | static __always_inline unsigned long bytes_is_zero(const u8 *start, | |
152 | size_t size) | |
153 | { | |
154 | while (size) { | |
155 | if (unlikely(*start)) | |
156 | return (unsigned long)start; | |
157 | start++; | |
158 | size--; | |
159 | } | |
160 | ||
161 | return 0; | |
162 | } | |
163 | ||
164 | static __always_inline unsigned long memory_is_zero(const void *start, | |
165 | const void *end) | |
166 | { | |
167 | unsigned int words; | |
168 | unsigned long ret; | |
169 | unsigned int prefix = (unsigned long)start % 8; | |
170 | ||
171 | if (end - start <= 16) | |
172 | return bytes_is_zero(start, end - start); | |
173 | ||
174 | if (prefix) { | |
175 | prefix = 8 - prefix; | |
176 | ret = bytes_is_zero(start, prefix); | |
177 | if (unlikely(ret)) | |
178 | return ret; | |
179 | start += prefix; | |
180 | } | |
181 | ||
182 | words = (end - start) / 8; | |
183 | while (words) { | |
184 | if (unlikely(*(u64 *)start)) | |
185 | return bytes_is_zero(start, 8); | |
186 | start += 8; | |
187 | words--; | |
188 | } | |
189 | ||
190 | return bytes_is_zero(start, (end - start) % 8); | |
191 | } | |
192 | ||
193 | static __always_inline bool memory_is_poisoned_n(unsigned long addr, | |
194 | size_t size) | |
195 | { | |
196 | unsigned long ret; | |
197 | ||
198 | ret = memory_is_zero(kasan_mem_to_shadow((void *)addr), | |
199 | kasan_mem_to_shadow((void *)addr + size - 1) + 1); | |
200 | ||
201 | if (unlikely(ret)) { | |
202 | unsigned long last_byte = addr + size - 1; | |
203 | s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); | |
204 | ||
205 | if (unlikely(ret != (unsigned long)last_shadow || | |
206 | ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) | |
207 | return true; | |
208 | } | |
209 | return false; | |
210 | } | |
211 | ||
212 | static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size) | |
213 | { | |
214 | if (__builtin_constant_p(size)) { | |
215 | switch (size) { | |
216 | case 1: | |
217 | return memory_is_poisoned_1(addr); | |
218 | case 2: | |
219 | return memory_is_poisoned_2(addr); | |
220 | case 4: | |
221 | return memory_is_poisoned_4(addr); | |
222 | case 8: | |
223 | return memory_is_poisoned_8(addr); | |
224 | case 16: | |
225 | return memory_is_poisoned_16(addr); | |
226 | default: | |
227 | BUILD_BUG(); | |
228 | } | |
229 | } | |
230 | ||
231 | return memory_is_poisoned_n(addr, size); | |
232 | } | |
233 | ||
234 | ||
235 | static __always_inline void check_memory_region(unsigned long addr, | |
236 | size_t size, bool write) | |
237 | { | |
238 | struct kasan_access_info info; | |
239 | ||
240 | if (unlikely(size == 0)) | |
241 | return; | |
242 | ||
243 | if (unlikely((void *)addr < | |
244 | kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) { | |
245 | info.access_addr = (void *)addr; | |
246 | info.access_size = size; | |
247 | info.is_write = write; | |
248 | info.ip = _RET_IP_; | |
249 | kasan_report_user_access(&info); | |
250 | return; | |
251 | } | |
252 | ||
253 | if (likely(!memory_is_poisoned(addr, size))) | |
254 | return; | |
255 | ||
256 | kasan_report(addr, size, write, _RET_IP_); | |
257 | } | |
258 | ||
393f203f AR |
259 | void __asan_loadN(unsigned long addr, size_t size); |
260 | void __asan_storeN(unsigned long addr, size_t size); | |
261 | ||
262 | #undef memset | |
263 | void *memset(void *addr, int c, size_t len) | |
264 | { | |
265 | __asan_storeN((unsigned long)addr, len); | |
266 | ||
267 | return __memset(addr, c, len); | |
268 | } | |
269 | ||
270 | #undef memmove | |
271 | void *memmove(void *dest, const void *src, size_t len) | |
272 | { | |
273 | __asan_loadN((unsigned long)src, len); | |
274 | __asan_storeN((unsigned long)dest, len); | |
275 | ||
276 | return __memmove(dest, src, len); | |
277 | } | |
278 | ||
279 | #undef memcpy | |
280 | void *memcpy(void *dest, const void *src, size_t len) | |
281 | { | |
282 | __asan_loadN((unsigned long)src, len); | |
283 | __asan_storeN((unsigned long)dest, len); | |
284 | ||
285 | return __memcpy(dest, src, len); | |
286 | } | |
287 | ||
b8c73fc2 AR |
288 | void kasan_alloc_pages(struct page *page, unsigned int order) |
289 | { | |
290 | if (likely(!PageHighMem(page))) | |
291 | kasan_unpoison_shadow(page_address(page), PAGE_SIZE << order); | |
292 | } | |
293 | ||
294 | void kasan_free_pages(struct page *page, unsigned int order) | |
295 | { | |
296 | if (likely(!PageHighMem(page))) | |
297 | kasan_poison_shadow(page_address(page), | |
298 | PAGE_SIZE << order, | |
299 | KASAN_FREE_PAGE); | |
300 | } | |
301 | ||
0316bec2 AR |
302 | void kasan_poison_slab(struct page *page) |
303 | { | |
304 | kasan_poison_shadow(page_address(page), | |
305 | PAGE_SIZE << compound_order(page), | |
306 | KASAN_KMALLOC_REDZONE); | |
307 | } | |
308 | ||
309 | void kasan_unpoison_object_data(struct kmem_cache *cache, void *object) | |
310 | { | |
311 | kasan_unpoison_shadow(object, cache->object_size); | |
312 | } | |
313 | ||
314 | void kasan_poison_object_data(struct kmem_cache *cache, void *object) | |
315 | { | |
316 | kasan_poison_shadow(object, | |
317 | round_up(cache->object_size, KASAN_SHADOW_SCALE_SIZE), | |
318 | KASAN_KMALLOC_REDZONE); | |
319 | } | |
320 | ||
321 | void kasan_slab_alloc(struct kmem_cache *cache, void *object) | |
322 | { | |
323 | kasan_kmalloc(cache, object, cache->object_size); | |
324 | } | |
325 | ||
326 | void kasan_slab_free(struct kmem_cache *cache, void *object) | |
327 | { | |
328 | unsigned long size = cache->object_size; | |
329 | unsigned long rounded_up_size = round_up(size, KASAN_SHADOW_SCALE_SIZE); | |
330 | ||
331 | /* RCU slabs could be legally used after free within the RCU period */ | |
332 | if (unlikely(cache->flags & SLAB_DESTROY_BY_RCU)) | |
333 | return; | |
334 | ||
335 | kasan_poison_shadow(object, rounded_up_size, KASAN_KMALLOC_FREE); | |
336 | } | |
337 | ||
338 | void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size) | |
339 | { | |
340 | unsigned long redzone_start; | |
341 | unsigned long redzone_end; | |
342 | ||
343 | if (unlikely(object == NULL)) | |
344 | return; | |
345 | ||
346 | redzone_start = round_up((unsigned long)(object + size), | |
347 | KASAN_SHADOW_SCALE_SIZE); | |
348 | redzone_end = round_up((unsigned long)object + cache->object_size, | |
349 | KASAN_SHADOW_SCALE_SIZE); | |
350 | ||
351 | kasan_unpoison_shadow(object, size); | |
352 | kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start, | |
353 | KASAN_KMALLOC_REDZONE); | |
354 | } | |
355 | EXPORT_SYMBOL(kasan_kmalloc); | |
356 | ||
357 | void kasan_kmalloc_large(const void *ptr, size_t size) | |
358 | { | |
359 | struct page *page; | |
360 | unsigned long redzone_start; | |
361 | unsigned long redzone_end; | |
362 | ||
363 | if (unlikely(ptr == NULL)) | |
364 | return; | |
365 | ||
366 | page = virt_to_page(ptr); | |
367 | redzone_start = round_up((unsigned long)(ptr + size), | |
368 | KASAN_SHADOW_SCALE_SIZE); | |
369 | redzone_end = (unsigned long)ptr + (PAGE_SIZE << compound_order(page)); | |
370 | ||
371 | kasan_unpoison_shadow(ptr, size); | |
372 | kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start, | |
373 | KASAN_PAGE_REDZONE); | |
374 | } | |
375 | ||
376 | void kasan_krealloc(const void *object, size_t size) | |
377 | { | |
378 | struct page *page; | |
379 | ||
380 | if (unlikely(object == ZERO_SIZE_PTR)) | |
381 | return; | |
382 | ||
383 | page = virt_to_head_page(object); | |
384 | ||
385 | if (unlikely(!PageSlab(page))) | |
386 | kasan_kmalloc_large(object, size); | |
387 | else | |
388 | kasan_kmalloc(page->slab_cache, object, size); | |
389 | } | |
390 | ||
92393615 AR |
391 | void kasan_kfree(void *ptr) |
392 | { | |
393 | struct page *page; | |
394 | ||
395 | page = virt_to_head_page(ptr); | |
396 | ||
397 | if (unlikely(!PageSlab(page))) | |
398 | kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page), | |
399 | KASAN_FREE_PAGE); | |
400 | else | |
401 | kasan_slab_free(page->slab_cache, ptr); | |
402 | } | |
403 | ||
0316bec2 AR |
404 | void kasan_kfree_large(const void *ptr) |
405 | { | |
406 | struct page *page = virt_to_page(ptr); | |
407 | ||
408 | kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page), | |
409 | KASAN_FREE_PAGE); | |
410 | } | |
411 | ||
bebf56a1 AR |
412 | int kasan_module_alloc(void *addr, size_t size) |
413 | { | |
414 | void *ret; | |
415 | size_t shadow_size; | |
416 | unsigned long shadow_start; | |
417 | ||
418 | shadow_start = (unsigned long)kasan_mem_to_shadow(addr); | |
419 | shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, | |
420 | PAGE_SIZE); | |
421 | ||
422 | if (WARN_ON(!PAGE_ALIGNED(shadow_start))) | |
423 | return -EINVAL; | |
424 | ||
425 | ret = __vmalloc_node_range(shadow_size, 1, shadow_start, | |
426 | shadow_start + shadow_size, | |
427 | GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, | |
428 | PAGE_KERNEL, VM_NO_GUARD, NUMA_NO_NODE, | |
429 | __builtin_return_address(0)); | |
a5af5aa8 AR |
430 | |
431 | if (ret) { | |
432 | find_vm_area(addr)->flags |= VM_KASAN; | |
433 | return 0; | |
434 | } | |
435 | ||
436 | return -ENOMEM; | |
bebf56a1 AR |
437 | } |
438 | ||
a5af5aa8 | 439 | void kasan_free_shadow(const struct vm_struct *vm) |
bebf56a1 | 440 | { |
a5af5aa8 AR |
441 | if (vm->flags & VM_KASAN) |
442 | vfree(kasan_mem_to_shadow(vm->addr)); | |
bebf56a1 AR |
443 | } |
444 | ||
445 | static void register_global(struct kasan_global *global) | |
446 | { | |
447 | size_t aligned_size = round_up(global->size, KASAN_SHADOW_SCALE_SIZE); | |
448 | ||
449 | kasan_unpoison_shadow(global->beg, global->size); | |
450 | ||
451 | kasan_poison_shadow(global->beg + aligned_size, | |
452 | global->size_with_redzone - aligned_size, | |
453 | KASAN_GLOBAL_REDZONE); | |
454 | } | |
455 | ||
456 | void __asan_register_globals(struct kasan_global *globals, size_t size) | |
457 | { | |
458 | int i; | |
459 | ||
460 | for (i = 0; i < size; i++) | |
461 | register_global(&globals[i]); | |
462 | } | |
463 | EXPORT_SYMBOL(__asan_register_globals); | |
464 | ||
465 | void __asan_unregister_globals(struct kasan_global *globals, size_t size) | |
466 | { | |
467 | } | |
468 | EXPORT_SYMBOL(__asan_unregister_globals); | |
469 | ||
0b24becc AR |
470 | #define DEFINE_ASAN_LOAD_STORE(size) \ |
471 | void __asan_load##size(unsigned long addr) \ | |
472 | { \ | |
473 | check_memory_region(addr, size, false); \ | |
474 | } \ | |
475 | EXPORT_SYMBOL(__asan_load##size); \ | |
476 | __alias(__asan_load##size) \ | |
477 | void __asan_load##size##_noabort(unsigned long); \ | |
478 | EXPORT_SYMBOL(__asan_load##size##_noabort); \ | |
479 | void __asan_store##size(unsigned long addr) \ | |
480 | { \ | |
481 | check_memory_region(addr, size, true); \ | |
482 | } \ | |
483 | EXPORT_SYMBOL(__asan_store##size); \ | |
484 | __alias(__asan_store##size) \ | |
485 | void __asan_store##size##_noabort(unsigned long); \ | |
486 | EXPORT_SYMBOL(__asan_store##size##_noabort) | |
487 | ||
488 | DEFINE_ASAN_LOAD_STORE(1); | |
489 | DEFINE_ASAN_LOAD_STORE(2); | |
490 | DEFINE_ASAN_LOAD_STORE(4); | |
491 | DEFINE_ASAN_LOAD_STORE(8); | |
492 | DEFINE_ASAN_LOAD_STORE(16); | |
493 | ||
494 | void __asan_loadN(unsigned long addr, size_t size) | |
495 | { | |
496 | check_memory_region(addr, size, false); | |
497 | } | |
498 | EXPORT_SYMBOL(__asan_loadN); | |
499 | ||
500 | __alias(__asan_loadN) | |
501 | void __asan_loadN_noabort(unsigned long, size_t); | |
502 | EXPORT_SYMBOL(__asan_loadN_noabort); | |
503 | ||
504 | void __asan_storeN(unsigned long addr, size_t size) | |
505 | { | |
506 | check_memory_region(addr, size, true); | |
507 | } | |
508 | EXPORT_SYMBOL(__asan_storeN); | |
509 | ||
510 | __alias(__asan_storeN) | |
511 | void __asan_storeN_noabort(unsigned long, size_t); | |
512 | EXPORT_SYMBOL(__asan_storeN_noabort); | |
513 | ||
514 | /* to shut up compiler complaints */ | |
515 | void __asan_handle_no_return(void) {} | |
516 | EXPORT_SYMBOL(__asan_handle_no_return); | |
786a8959 AR |
517 | |
518 | #ifdef CONFIG_MEMORY_HOTPLUG | |
519 | static int kasan_mem_notifier(struct notifier_block *nb, | |
520 | unsigned long action, void *data) | |
521 | { | |
522 | return (action == MEM_GOING_ONLINE) ? NOTIFY_BAD : NOTIFY_OK; | |
523 | } | |
524 | ||
525 | static int __init kasan_memhotplug_init(void) | |
526 | { | |
527 | pr_err("WARNING: KASan doesn't support memory hot-add\n"); | |
528 | pr_err("Memory hot-add will be disabled\n"); | |
529 | ||
530 | hotplug_memory_notifier(kasan_mem_notifier, 0); | |
531 | ||
532 | return 0; | |
533 | } | |
534 | ||
535 | module_init(kasan_memhotplug_init); | |
536 | #endif |