2 * This file contains error reporting code.
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
7 * Some code borrowed from https://github.com/xairy/kasan-prototype by
8 * Andrey Konovalov <adech.fo@gmail.com>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
18 #include <linux/printk.h>
19 #include <linux/sched.h>
20 #include <linux/slab.h>
21 #include <linux/stacktrace.h>
22 #include <linux/string.h>
23 #include <linux/types.h>
24 #include <linux/kasan.h>
25 #include <linux/module.h>
27 #include <asm/sections.h>
32 /* Shadow layout customization. */
33 #define SHADOW_BYTES_PER_BLOCK 1
34 #define SHADOW_BLOCKS_PER_ROW 16
35 #define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK)
36 #define SHADOW_ROWS_AROUND_ADDR 2
38 static const void *find_first_bad_addr(const void *addr
, size_t size
)
40 u8 shadow_val
= *(u8
*)kasan_mem_to_shadow(addr
);
41 const void *first_bad_addr
= addr
;
43 while (!shadow_val
&& first_bad_addr
< addr
+ size
) {
44 first_bad_addr
+= KASAN_SHADOW_SCALE_SIZE
;
45 shadow_val
= *(u8
*)kasan_mem_to_shadow(first_bad_addr
);
47 return first_bad_addr
;
50 static void print_error_description(struct kasan_access_info
*info
)
52 const char *bug_type
= "unknown-crash";
55 info
->first_bad_addr
= find_first_bad_addr(info
->access_addr
,
58 shadow_addr
= (u8
*)kasan_mem_to_shadow(info
->first_bad_addr
);
61 * If shadow byte value is in [0, KASAN_SHADOW_SCALE_SIZE) we can look
62 * at the next shadow byte to determine the type of the bad access.
64 if (*shadow_addr
> 0 && *shadow_addr
<= KASAN_SHADOW_SCALE_SIZE
- 1)
67 switch (*shadow_addr
) {
68 case 0 ... KASAN_SHADOW_SCALE_SIZE
- 1:
70 * In theory it's still possible to see these shadow values
71 * due to a data race in the kernel code.
73 bug_type
= "out-of-bounds";
75 case KASAN_PAGE_REDZONE
:
76 case KASAN_KMALLOC_REDZONE
:
77 bug_type
= "slab-out-of-bounds";
79 case KASAN_GLOBAL_REDZONE
:
80 bug_type
= "global-out-of-bounds";
82 case KASAN_STACK_LEFT
:
84 case KASAN_STACK_RIGHT
:
85 case KASAN_STACK_PARTIAL
:
86 bug_type
= "stack-out-of-bounds";
89 case KASAN_KMALLOC_FREE
:
90 bug_type
= "use-after-free";
94 pr_err("BUG: KASAN: %s in %pS at addr %p\n",
95 bug_type
, (void *)info
->ip
,
97 pr_err("%s of size %zu by task %s/%d\n",
98 info
->is_write
? "Write" : "Read",
99 info
->access_size
, current
->comm
, task_pid_nr(current
));
102 static inline bool kernel_or_module_addr(const void *addr
)
104 if (addr
>= (void *)_stext
&& addr
< (void *)_end
)
106 if (is_module_address((unsigned long)addr
))
111 static inline bool init_task_stack_addr(const void *addr
)
113 return addr
>= (void *)&init_thread_union
.stack
&&
114 (addr
<= (void *)&init_thread_union
.stack
+
115 sizeof(init_thread_union
.stack
));
119 static void print_track(struct kasan_track
*track
)
121 pr_err("PID = %u, CPU = %u, timestamp = %lu\n", track
->pid
,
122 track
->cpu
, (unsigned long)track
->when
);
125 static void object_err(struct kmem_cache
*cache
, struct page
*page
,
126 void *object
, char *unused_reason
)
128 struct kasan_alloc_meta
*alloc_info
= get_alloc_info(cache
, object
);
129 struct kasan_free_meta
*free_info
;
132 pr_err("Object at %p, in cache %s\n", object
, cache
->name
);
133 if (!(cache
->flags
& SLAB_KASAN
))
135 switch (alloc_info
->state
) {
136 case KASAN_STATE_INIT
:
137 pr_err("Object not allocated yet\n");
139 case KASAN_STATE_ALLOC
:
140 pr_err("Object allocated with size %u bytes.\n",
141 alloc_info
->alloc_size
);
142 pr_err("Allocation:\n");
143 print_track(&alloc_info
->track
);
145 case KASAN_STATE_FREE
:
146 pr_err("Object freed, allocated with size %u bytes\n",
147 alloc_info
->alloc_size
);
148 free_info
= get_free_info(cache
, object
);
149 pr_err("Allocation:\n");
150 print_track(&alloc_info
->track
);
151 pr_err("Deallocation:\n");
152 print_track(&free_info
->track
);
158 static void print_address_description(struct kasan_access_info
*info
)
160 const void *addr
= info
->access_addr
;
162 if ((addr
>= (void *)PAGE_OFFSET
) &&
163 (addr
< high_memory
)) {
164 struct page
*page
= virt_to_head_page(addr
);
166 if (PageSlab(page
)) {
168 struct kmem_cache
*cache
= page
->slab_cache
;
169 object
= nearest_obj(cache
, page
,
170 (void *)info
->access_addr
);
171 object_err(cache
, page
, object
,
172 "kasan: bad access detected");
175 dump_page(page
, "kasan: bad access detected");
178 if (kernel_or_module_addr(addr
)) {
179 if (!init_task_stack_addr(addr
))
180 pr_err("Address belongs to variable %pS\n", addr
);
185 static bool row_is_guilty(const void *row
, const void *guilty
)
187 return (row
<= guilty
) && (guilty
< row
+ SHADOW_BYTES_PER_ROW
);
190 static int shadow_pointer_offset(const void *row
, const void *shadow
)
192 /* The length of ">ff00ff00ff00ff00: " is
193 * 3 + (BITS_PER_LONG/8)*2 chars.
195 return 3 + (BITS_PER_LONG
/8)*2 + (shadow
- row
)*2 +
196 (shadow
- row
) / SHADOW_BYTES_PER_BLOCK
+ 1;
199 static void print_shadow_for_address(const void *addr
)
202 const void *shadow
= kasan_mem_to_shadow(addr
);
203 const void *shadow_row
;
205 shadow_row
= (void *)round_down((unsigned long)shadow
,
206 SHADOW_BYTES_PER_ROW
)
207 - SHADOW_ROWS_AROUND_ADDR
* SHADOW_BYTES_PER_ROW
;
209 pr_err("Memory state around the buggy address:\n");
211 for (i
= -SHADOW_ROWS_AROUND_ADDR
; i
<= SHADOW_ROWS_AROUND_ADDR
; i
++) {
212 const void *kaddr
= kasan_shadow_to_mem(shadow_row
);
213 char buffer
[4 + (BITS_PER_LONG
/8)*2];
214 char shadow_buf
[SHADOW_BYTES_PER_ROW
];
216 snprintf(buffer
, sizeof(buffer
),
217 (i
== 0) ? ">%p: " : " %p: ", kaddr
);
219 * We should not pass a shadow pointer to generic
220 * function, because generic functions may try to
221 * access kasan mapping for the passed address.
223 memcpy(shadow_buf
, shadow_row
, SHADOW_BYTES_PER_ROW
);
224 print_hex_dump(KERN_ERR
, buffer
,
225 DUMP_PREFIX_NONE
, SHADOW_BYTES_PER_ROW
, 1,
226 shadow_buf
, SHADOW_BYTES_PER_ROW
, 0);
228 if (row_is_guilty(shadow_row
, shadow
))
230 shadow_pointer_offset(shadow_row
, shadow
),
233 shadow_row
+= SHADOW_BYTES_PER_ROW
;
237 static DEFINE_SPINLOCK(report_lock
);
239 static void kasan_report_error(struct kasan_access_info
*info
)
242 const char *bug_type
;
245 * Make sure we don't end up in loop.
247 kasan_disable_current();
248 spin_lock_irqsave(&report_lock
, flags
);
249 pr_err("==================================================================\n");
250 if (info
->access_addr
<
251 kasan_shadow_to_mem((void *)KASAN_SHADOW_START
)) {
252 if ((unsigned long)info
->access_addr
< PAGE_SIZE
)
253 bug_type
= "null-ptr-deref";
254 else if ((unsigned long)info
->access_addr
< TASK_SIZE
)
255 bug_type
= "user-memory-access";
257 bug_type
= "wild-memory-access";
258 pr_err("BUG: KASAN: %s on address %p\n",
259 bug_type
, info
->access_addr
);
260 pr_err("%s of size %zu by task %s/%d\n",
261 info
->is_write
? "Write" : "Read",
262 info
->access_size
, current
->comm
,
263 task_pid_nr(current
));
266 print_error_description(info
);
267 print_address_description(info
);
268 print_shadow_for_address(info
->first_bad_addr
);
270 pr_err("==================================================================\n");
271 add_taint(TAINT_BAD_PAGE
, LOCKDEP_NOW_UNRELIABLE
);
272 spin_unlock_irqrestore(&report_lock
, flags
);
273 kasan_enable_current();
276 void kasan_report(unsigned long addr
, size_t size
,
277 bool is_write
, unsigned long ip
)
279 struct kasan_access_info info
;
281 if (likely(!kasan_report_enabled()))
284 info
.access_addr
= (void *)addr
;
285 info
.access_size
= size
;
286 info
.is_write
= is_write
;
289 kasan_report_error(&info
);
293 #define DEFINE_ASAN_REPORT_LOAD(size) \
294 void __asan_report_load##size##_noabort(unsigned long addr) \
296 kasan_report(addr, size, false, _RET_IP_); \
298 EXPORT_SYMBOL(__asan_report_load##size##_noabort)
300 #define DEFINE_ASAN_REPORT_STORE(size) \
301 void __asan_report_store##size##_noabort(unsigned long addr) \
303 kasan_report(addr, size, true, _RET_IP_); \
305 EXPORT_SYMBOL(__asan_report_store##size##_noabort)
307 DEFINE_ASAN_REPORT_LOAD(1);
308 DEFINE_ASAN_REPORT_LOAD(2);
309 DEFINE_ASAN_REPORT_LOAD(4);
310 DEFINE_ASAN_REPORT_LOAD(8);
311 DEFINE_ASAN_REPORT_LOAD(16);
312 DEFINE_ASAN_REPORT_STORE(1);
313 DEFINE_ASAN_REPORT_STORE(2);
314 DEFINE_ASAN_REPORT_STORE(4);
315 DEFINE_ASAN_REPORT_STORE(8);
316 DEFINE_ASAN_REPORT_STORE(16);
318 void __asan_report_load_n_noabort(unsigned long addr
, size_t size
)
320 kasan_report(addr
, size
, false, _RET_IP_
);
322 EXPORT_SYMBOL(__asan_report_load_n_noabort
);
324 void __asan_report_store_n_noabort(unsigned long addr
, size_t size
)
326 kasan_report(addr
, size
, true, _RET_IP_
);
328 EXPORT_SYMBOL(__asan_report_store_n_noabort
);