1
2
3
4
5
6
7
8
9
10
11
12#include <linux/bitops.h>
13#include <linux/ftrace.h>
14#include <linux/init.h>
15#include <linux/kernel.h>
16#include <linux/mm.h>
17#include <linux/printk.h>
18#include <linux/sched.h>
19#include <linux/slab.h>
20#include <linux/stackdepot.h>
21#include <linux/stacktrace.h>
22#include <linux/string.h>
23#include <linux/types.h>
24#include <linux/kasan.h>
25#include <linux/module.h>
26#include <linux/sched/task_stack.h>
27#include <linux/uaccess.h>
28#include <trace/events/error_report.h>
29
30#include <asm/sections.h>
31
32#include <kunit/test.h>
33
34#include "kasan.h"
35#include "../slab.h"
36
37static unsigned long kasan_flags;
38
39#define KASAN_BIT_REPORTED 0
40#define KASAN_BIT_MULTI_SHOT 1
41
42enum kasan_arg_fault {
43 KASAN_ARG_FAULT_DEFAULT,
44 KASAN_ARG_FAULT_REPORT,
45 KASAN_ARG_FAULT_PANIC,
46};
47
48static enum kasan_arg_fault kasan_arg_fault __ro_after_init = KASAN_ARG_FAULT_DEFAULT;
49
50
51static int __init early_kasan_fault(char *arg)
52{
53 if (!arg)
54 return -EINVAL;
55
56 if (!strcmp(arg, "report"))
57 kasan_arg_fault = KASAN_ARG_FAULT_REPORT;
58 else if (!strcmp(arg, "panic"))
59 kasan_arg_fault = KASAN_ARG_FAULT_PANIC;
60 else
61 return -EINVAL;
62
63 return 0;
64}
65early_param("kasan.fault", early_kasan_fault);
66
67bool kasan_save_enable_multi_shot(void)
68{
69 return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
70}
71EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
72
73void kasan_restore_multi_shot(bool enabled)
74{
75 if (!enabled)
76 clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
77}
78EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
79
80static int __init kasan_set_multi_shot(char *str)
81{
82 set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
83 return 1;
84}
85__setup("kasan_multi_shot", kasan_set_multi_shot);
86
87static void print_error_description(struct kasan_access_info *info)
88{
89 pr_err("BUG: KASAN: %s in %pS\n",
90 kasan_get_bug_type(info), (void *)info->ip);
91 if (info->access_size)
92 pr_err("%s of size %zu at addr %px by task %s/%d\n",
93 info->is_write ? "Write" : "Read", info->access_size,
94 info->access_addr, current->comm, task_pid_nr(current));
95 else
96 pr_err("%s at addr %px by task %s/%d\n",
97 info->is_write ? "Write" : "Read",
98 info->access_addr, current->comm, task_pid_nr(current));
99}
100
101static DEFINE_SPINLOCK(report_lock);
102
103static void start_report(unsigned long *flags)
104{
105
106
107
108 kasan_disable_current();
109 spin_lock_irqsave(&report_lock, *flags);
110 pr_err("==================================================================\n");
111}
112
113static void end_report(unsigned long *flags, unsigned long addr)
114{
115 if (!kasan_async_mode_enabled())
116 trace_error_report_end(ERROR_DETECTOR_KASAN, addr);
117 pr_err("==================================================================\n");
118 add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
119 spin_unlock_irqrestore(&report_lock, *flags);
120 if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) {
121
122
123
124
125
126
127 panic_on_warn = 0;
128 panic("panic_on_warn set ...\n");
129 }
130 if (kasan_arg_fault == KASAN_ARG_FAULT_PANIC)
131 panic("kasan.fault=panic set ...\n");
132 kasan_enable_current();
133}
134
135static void print_stack(depot_stack_handle_t stack)
136{
137 unsigned long *entries;
138 unsigned int nr_entries;
139
140 nr_entries = stack_depot_fetch(stack, &entries);
141 stack_trace_print(entries, nr_entries, 0);
142}
143
144static void print_track(struct kasan_track *track, const char *prefix)
145{
146 pr_err("%s by task %u:\n", prefix, track->pid);
147 if (track->stack) {
148 print_stack(track->stack);
149 } else {
150 pr_err("(stack is not available)\n");
151 }
152}
153
154struct page *kasan_addr_to_page(const void *addr)
155{
156 if ((addr >= (void *)PAGE_OFFSET) &&
157 (addr < high_memory))
158 return virt_to_head_page(addr);
159 return NULL;
160}
161
162static void describe_object_addr(struct kmem_cache *cache, void *object,
163 const void *addr)
164{
165 unsigned long access_addr = (unsigned long)addr;
166 unsigned long object_addr = (unsigned long)object;
167 const char *rel_type;
168 int rel_bytes;
169
170 pr_err("The buggy address belongs to the object at %px\n"
171 " which belongs to the cache %s of size %d\n",
172 object, cache->name, cache->object_size);
173
174 if (!addr)
175 return;
176
177 if (access_addr < object_addr) {
178 rel_type = "to the left";
179 rel_bytes = object_addr - access_addr;
180 } else if (access_addr >= object_addr + cache->object_size) {
181 rel_type = "to the right";
182 rel_bytes = access_addr - (object_addr + cache->object_size);
183 } else {
184 rel_type = "inside";
185 rel_bytes = access_addr - object_addr;
186 }
187
188 pr_err("The buggy address is located %d bytes %s of\n"
189 " %d-byte region [%px, %px)\n",
190 rel_bytes, rel_type, cache->object_size, (void *)object_addr,
191 (void *)(object_addr + cache->object_size));
192}
193
194static void describe_object_stacks(struct kmem_cache *cache, void *object,
195 const void *addr, u8 tag)
196{
197 struct kasan_alloc_meta *alloc_meta;
198 struct kasan_track *free_track;
199
200 alloc_meta = kasan_get_alloc_meta(cache, object);
201 if (alloc_meta) {
202 print_track(&alloc_meta->alloc_track, "Allocated");
203 pr_err("\n");
204 }
205
206 free_track = kasan_get_free_track(cache, object, tag);
207 if (free_track) {
208 print_track(free_track, "Freed");
209 pr_err("\n");
210 }
211
212#ifdef CONFIG_KASAN_GENERIC
213 if (!alloc_meta)
214 return;
215 if (alloc_meta->aux_stack[0]) {
216 pr_err("Last potentially related work creation:\n");
217 print_stack(alloc_meta->aux_stack[0]);
218 pr_err("\n");
219 }
220 if (alloc_meta->aux_stack[1]) {
221 pr_err("Second to last potentially related work creation:\n");
222 print_stack(alloc_meta->aux_stack[1]);
223 pr_err("\n");
224 }
225#endif
226}
227
228static void describe_object(struct kmem_cache *cache, void *object,
229 const void *addr, u8 tag)
230{
231 if (kasan_stack_collection_enabled())
232 describe_object_stacks(cache, object, addr, tag);
233 describe_object_addr(cache, object, addr);
234}
235
236static inline bool kernel_or_module_addr(const void *addr)
237{
238 if (addr >= (void *)_stext && addr < (void *)_end)
239 return true;
240 if (is_module_address((unsigned long)addr))
241 return true;
242 return false;
243}
244
245static inline bool init_task_stack_addr(const void *addr)
246{
247 return addr >= (void *)&init_thread_union.stack &&
248 (addr <= (void *)&init_thread_union.stack +
249 sizeof(init_thread_union.stack));
250}
251
252static void print_address_description(void *addr, u8 tag)
253{
254 struct page *page = kasan_addr_to_page(addr);
255
256 dump_stack_lvl(KERN_ERR);
257 pr_err("\n");
258
259 if (page && PageSlab(page)) {
260 struct kmem_cache *cache = page->slab_cache;
261 void *object = nearest_obj(cache, page, addr);
262
263 describe_object(cache, object, addr, tag);
264 }
265
266 if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) {
267 pr_err("The buggy address belongs to the variable:\n");
268 pr_err(" %pS\n", addr);
269 }
270
271 if (page) {
272 pr_err("The buggy address belongs to the page:\n");
273 dump_page(page, "kasan: bad access detected");
274 }
275
276 kasan_print_address_stack_frame(addr);
277}
278
279static bool meta_row_is_guilty(const void *row, const void *addr)
280{
281 return (row <= addr) && (addr < row + META_MEM_BYTES_PER_ROW);
282}
283
284static int meta_pointer_offset(const void *row, const void *addr)
285{
286
287
288
289
290
291
292
293
294
295
296 return 3 + (BITS_PER_LONG / 8) * 2 +
297 (addr - row) / KASAN_GRANULE_SIZE * 3 + 1;
298}
299
300static void print_memory_metadata(const void *addr)
301{
302 int i;
303 void *row;
304
305 row = (void *)round_down((unsigned long)addr, META_MEM_BYTES_PER_ROW)
306 - META_ROWS_AROUND_ADDR * META_MEM_BYTES_PER_ROW;
307
308 pr_err("Memory state around the buggy address:\n");
309
310 for (i = -META_ROWS_AROUND_ADDR; i <= META_ROWS_AROUND_ADDR; i++) {
311 char buffer[4 + (BITS_PER_LONG / 8) * 2];
312 char metadata[META_BYTES_PER_ROW];
313
314 snprintf(buffer, sizeof(buffer),
315 (i == 0) ? ">%px: " : " %px: ", row);
316
317
318
319
320
321
322 kasan_metadata_fetch_row(&metadata[0], row);
323
324 print_hex_dump(KERN_ERR, buffer,
325 DUMP_PREFIX_NONE, META_BYTES_PER_ROW, 1,
326 metadata, META_BYTES_PER_ROW, 0);
327
328 if (meta_row_is_guilty(row, addr))
329 pr_err("%*c\n", meta_pointer_offset(row, addr), '^');
330
331 row += META_MEM_BYTES_PER_ROW;
332 }
333}
334
335static bool report_enabled(void)
336{
337#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
338 if (current->kasan_depth)
339 return false;
340#endif
341 if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
342 return true;
343 return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
344}
345
346#if IS_ENABLED(CONFIG_KUNIT)
347static void kasan_update_kunit_status(struct kunit *cur_test)
348{
349 struct kunit_resource *resource;
350 struct kunit_kasan_expectation *kasan_data;
351
352 resource = kunit_find_named_resource(cur_test, "kasan_data");
353
354 if (!resource) {
355 kunit_set_failure(cur_test);
356 return;
357 }
358
359 kasan_data = (struct kunit_kasan_expectation *)resource->data;
360 WRITE_ONCE(kasan_data->report_found, true);
361 kunit_put_resource(resource);
362}
363#endif
364
365void kasan_report_invalid_free(void *object, unsigned long ip)
366{
367 unsigned long flags;
368 u8 tag = get_tag(object);
369
370 object = kasan_reset_tag(object);
371
372#if IS_ENABLED(CONFIG_KUNIT)
373 if (current->kunit_test)
374 kasan_update_kunit_status(current->kunit_test);
375#endif
376
377 start_report(&flags);
378 pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
379 kasan_print_tags(tag, object);
380 pr_err("\n");
381 print_address_description(object, tag);
382 pr_err("\n");
383 print_memory_metadata(object);
384 end_report(&flags, (unsigned long)object);
385}
386
387#ifdef CONFIG_KASAN_HW_TAGS
388void kasan_report_async(void)
389{
390 unsigned long flags;
391
392#if IS_ENABLED(CONFIG_KUNIT)
393 if (current->kunit_test)
394 kasan_update_kunit_status(current->kunit_test);
395#endif
396
397 start_report(&flags);
398 pr_err("BUG: KASAN: invalid-access\n");
399 pr_err("Asynchronous mode enabled: no access details available\n");
400 pr_err("\n");
401 dump_stack_lvl(KERN_ERR);
402 end_report(&flags, 0);
403}
404#endif
405
406static void __kasan_report(unsigned long addr, size_t size, bool is_write,
407 unsigned long ip)
408{
409 struct kasan_access_info info;
410 void *tagged_addr;
411 void *untagged_addr;
412 unsigned long flags;
413
414#if IS_ENABLED(CONFIG_KUNIT)
415 if (current->kunit_test)
416 kasan_update_kunit_status(current->kunit_test);
417#endif
418
419 disable_trace_on_warning();
420
421 tagged_addr = (void *)addr;
422 untagged_addr = kasan_reset_tag(tagged_addr);
423
424 info.access_addr = tagged_addr;
425 if (addr_has_metadata(untagged_addr))
426 info.first_bad_addr =
427 kasan_find_first_bad_addr(tagged_addr, size);
428 else
429 info.first_bad_addr = untagged_addr;
430 info.access_size = size;
431 info.is_write = is_write;
432 info.ip = ip;
433
434 start_report(&flags);
435
436 print_error_description(&info);
437 if (addr_has_metadata(untagged_addr))
438 kasan_print_tags(get_tag(tagged_addr), info.first_bad_addr);
439 pr_err("\n");
440
441 if (addr_has_metadata(untagged_addr)) {
442 print_address_description(untagged_addr, get_tag(tagged_addr));
443 pr_err("\n");
444 print_memory_metadata(info.first_bad_addr);
445 } else {
446 dump_stack_lvl(KERN_ERR);
447 }
448
449 end_report(&flags, addr);
450}
451
452bool kasan_report(unsigned long addr, size_t size, bool is_write,
453 unsigned long ip)
454{
455 unsigned long flags = user_access_save();
456 bool ret = false;
457
458 if (likely(report_enabled())) {
459 __kasan_report(addr, size, is_write, ip);
460 ret = true;
461 }
462
463 user_access_restore(flags);
464
465 return ret;
466}
467
468#ifdef CONFIG_KASAN_INLINE
469
470
471
472
473
474
475
476
477void kasan_non_canonical_hook(unsigned long addr)
478{
479 unsigned long orig_addr;
480 const char *bug_type;
481
482 if (addr < KASAN_SHADOW_OFFSET)
483 return;
484
485 orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT;
486
487
488
489
490
491
492
493
494
495
496
497 if (orig_addr < PAGE_SIZE)
498 bug_type = "null-ptr-deref";
499 else if (orig_addr < TASK_SIZE)
500 bug_type = "probably user-memory-access";
501 else
502 bug_type = "maybe wild-memory-access";
503 pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,
504 orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1);
505}
506#endif
507