1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/bitops.h>
18#include <linux/ftrace.h>
19#include <linux/init.h>
20#include <linux/kernel.h>
21#include <linux/mm.h>
22#include <linux/printk.h>
23#include <linux/sched.h>
24#include <linux/slab.h>
25#include <linux/stackdepot.h>
26#include <linux/stacktrace.h>
27#include <linux/string.h>
28#include <linux/types.h>
29#include <linux/kasan.h>
30#include <linux/module.h>
31#include <linux/sched/task_stack.h>
32
33#include <asm/sections.h>
34
35#include "kasan.h"
36#include "../slab.h"
37
38
39#define SHADOW_BYTES_PER_BLOCK 1
40#define SHADOW_BLOCKS_PER_ROW 16
41#define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK)
42#define SHADOW_ROWS_AROUND_ADDR 2
43
44static unsigned long kasan_flags;
45
46#define KASAN_BIT_REPORTED 0
47#define KASAN_BIT_MULTI_SHOT 1
48
49bool kasan_save_enable_multi_shot(void)
50{
51 return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
52}
53EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
54
55void kasan_restore_multi_shot(bool enabled)
56{
57 if (!enabled)
58 clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
59}
60EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
61
62static int __init kasan_set_multi_shot(char *str)
63{
64 set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
65 return 1;
66}
67__setup("kasan_multi_shot", kasan_set_multi_shot);
68
69static void print_error_description(struct kasan_access_info *info)
70{
71 pr_err("BUG: KASAN: %s in %pS\n",
72 get_bug_type(info), (void *)info->ip);
73 pr_err("%s of size %zu at addr %px by task %s/%d\n",
74 info->is_write ? "Write" : "Read", info->access_size,
75 info->access_addr, current->comm, task_pid_nr(current));
76}
77
78static DEFINE_SPINLOCK(report_lock);
79
80static void start_report(unsigned long *flags)
81{
82
83
84
85 kasan_disable_current();
86 spin_lock_irqsave(&report_lock, *flags);
87 pr_err("==================================================================\n");
88}
89
90static void end_report(unsigned long *flags)
91{
92 pr_err("==================================================================\n");
93 add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
94 spin_unlock_irqrestore(&report_lock, *flags);
95 if (panic_on_warn)
96 panic("panic_on_warn set ...\n");
97 kasan_enable_current();
98}
99
100static void print_track(struct kasan_track *track, const char *prefix)
101{
102 pr_err("%s by task %u:\n", prefix, track->pid);
103 if (track->stack) {
104 unsigned long *entries;
105 unsigned int nr_entries;
106
107 nr_entries = stack_depot_fetch(track->stack, &entries);
108 stack_trace_print(entries, nr_entries, 0);
109 } else {
110 pr_err("(stack is not available)\n");
111 }
112}
113
114static struct page *addr_to_page(const void *addr)
115{
116 if ((addr >= (void *)PAGE_OFFSET) &&
117 (addr < high_memory))
118 return virt_to_head_page(addr);
119 return NULL;
120}
121
122static void describe_object_addr(struct kmem_cache *cache, void *object,
123 const void *addr)
124{
125 unsigned long access_addr = (unsigned long)addr;
126 unsigned long object_addr = (unsigned long)object;
127 const char *rel_type;
128 int rel_bytes;
129
130 pr_err("The buggy address belongs to the object at %px\n"
131 " which belongs to the cache %s of size %d\n",
132 object, cache->name, cache->object_size);
133
134 if (!addr)
135 return;
136
137 if (access_addr < object_addr) {
138 rel_type = "to the left";
139 rel_bytes = object_addr - access_addr;
140 } else if (access_addr >= object_addr + cache->object_size) {
141 rel_type = "to the right";
142 rel_bytes = access_addr - (object_addr + cache->object_size);
143 } else {
144 rel_type = "inside";
145 rel_bytes = access_addr - object_addr;
146 }
147
148 pr_err("The buggy address is located %d bytes %s of\n"
149 " %d-byte region [%px, %px)\n",
150 rel_bytes, rel_type, cache->object_size, (void *)object_addr,
151 (void *)(object_addr + cache->object_size));
152}
153
154static void describe_object(struct kmem_cache *cache, void *object,
155 const void *addr)
156{
157 struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
158
159 if (cache->flags & SLAB_KASAN) {
160 print_track(&alloc_info->alloc_track, "Allocated");
161 pr_err("\n");
162 print_track(&alloc_info->free_track, "Freed");
163 pr_err("\n");
164 }
165
166 describe_object_addr(cache, object, addr);
167}
168
169static inline bool kernel_or_module_addr(const void *addr)
170{
171 if (addr >= (void *)_stext && addr < (void *)_end)
172 return true;
173 if (is_module_address((unsigned long)addr))
174 return true;
175 return false;
176}
177
178static inline bool init_task_stack_addr(const void *addr)
179{
180 return addr >= (void *)&init_thread_union.stack &&
181 (addr <= (void *)&init_thread_union.stack +
182 sizeof(init_thread_union.stack));
183}
184
185static bool __must_check tokenize_frame_descr(const char **frame_descr,
186 char *token, size_t max_tok_len,
187 unsigned long *value)
188{
189 const char *sep = strchr(*frame_descr, ' ');
190
191 if (sep == NULL)
192 sep = *frame_descr + strlen(*frame_descr);
193
194 if (token != NULL) {
195 const size_t tok_len = sep - *frame_descr;
196
197 if (tok_len + 1 > max_tok_len) {
198 pr_err("KASAN internal error: frame description too long: %s\n",
199 *frame_descr);
200 return false;
201 }
202
203
204 strlcpy(token, *frame_descr, tok_len + 1);
205 }
206
207
208 *frame_descr = sep + 1;
209
210 if (value != NULL && kstrtoul(token, 10, value)) {
211 pr_err("KASAN internal error: not a valid number: %s\n", token);
212 return false;
213 }
214
215 return true;
216}
217
218static void print_decoded_frame_descr(const char *frame_descr)
219{
220
221
222
223
224
225
226
227
228 char token[64];
229 unsigned long num_objects;
230
231 if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
232 &num_objects))
233 return;
234
235 pr_err("\n");
236 pr_err("this frame has %lu %s:\n", num_objects,
237 num_objects == 1 ? "object" : "objects");
238
239 while (num_objects--) {
240 unsigned long offset;
241 unsigned long size;
242
243
244 if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
245 &offset))
246 return;
247
248 if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
249 &size))
250 return;
251
252 if (!tokenize_frame_descr(&frame_descr, NULL, 0, NULL))
253 return;
254
255 if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
256 NULL))
257 return;
258
259
260 strreplace(token, ':', '\0');
261
262
263 pr_err(" [%lu, %lu) '%s'", offset, offset + size, token);
264 }
265}
266
267static bool __must_check get_address_stack_frame_info(const void *addr,
268 unsigned long *offset,
269 const char **frame_descr,
270 const void **frame_pc)
271{
272 unsigned long aligned_addr;
273 unsigned long mem_ptr;
274 const u8 *shadow_bottom;
275 const u8 *shadow_ptr;
276 const unsigned long *frame;
277
278 BUILD_BUG_ON(IS_ENABLED(CONFIG_STACK_GROWSUP));
279
280
281
282
283
284 if (!object_is_on_stack(addr))
285 return false;
286
287 aligned_addr = round_down((unsigned long)addr, sizeof(long));
288 mem_ptr = round_down(aligned_addr, KASAN_SHADOW_SCALE_SIZE);
289 shadow_ptr = kasan_mem_to_shadow((void *)aligned_addr);
290 shadow_bottom = kasan_mem_to_shadow(end_of_stack(current));
291
292 while (shadow_ptr >= shadow_bottom && *shadow_ptr != KASAN_STACK_LEFT) {
293 shadow_ptr--;
294 mem_ptr -= KASAN_SHADOW_SCALE_SIZE;
295 }
296
297 while (shadow_ptr >= shadow_bottom && *shadow_ptr == KASAN_STACK_LEFT) {
298 shadow_ptr--;
299 mem_ptr -= KASAN_SHADOW_SCALE_SIZE;
300 }
301
302 if (shadow_ptr < shadow_bottom)
303 return false;
304
305 frame = (const unsigned long *)(mem_ptr + KASAN_SHADOW_SCALE_SIZE);
306 if (frame[0] != KASAN_CURRENT_STACK_FRAME_MAGIC) {
307 pr_err("KASAN internal error: frame info validation failed; invalid marker: %lu\n",
308 frame[0]);
309 return false;
310 }
311
312 *offset = (unsigned long)addr - (unsigned long)frame;
313 *frame_descr = (const char *)frame[1];
314 *frame_pc = (void *)frame[2];
315
316 return true;
317}
318
319static void print_address_stack_frame(const void *addr)
320{
321 unsigned long offset;
322 const char *frame_descr;
323 const void *frame_pc;
324
325 if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
326 return;
327
328 if (!get_address_stack_frame_info(addr, &offset, &frame_descr,
329 &frame_pc))
330 return;
331
332
333
334
335
336 pr_err("\n");
337 pr_err("addr %px is located in stack of task %s/%d at offset %lu in frame:\n",
338 addr, current->comm, task_pid_nr(current), offset);
339 pr_err(" %pS\n", frame_pc);
340
341 if (!frame_descr)
342 return;
343
344 print_decoded_frame_descr(frame_descr);
345}
346
347static void print_address_description(void *addr)
348{
349 struct page *page = addr_to_page(addr);
350
351 dump_stack();
352 pr_err("\n");
353
354 if (page && PageSlab(page)) {
355 struct kmem_cache *cache = page->slab_cache;
356 void *object = nearest_obj(cache, page, addr);
357
358 describe_object(cache, object, addr);
359 }
360
361 if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) {
362 pr_err("The buggy address belongs to the variable:\n");
363 pr_err(" %pS\n", addr);
364 }
365
366 if (page) {
367 pr_err("The buggy address belongs to the page:\n");
368 dump_page(page, "kasan: bad access detected");
369 }
370
371 print_address_stack_frame(addr);
372}
373
374static bool row_is_guilty(const void *row, const void *guilty)
375{
376 return (row <= guilty) && (guilty < row + SHADOW_BYTES_PER_ROW);
377}
378
379static int shadow_pointer_offset(const void *row, const void *shadow)
380{
381
382
383
384 return 3 + (BITS_PER_LONG/8)*2 + (shadow - row)*2 +
385 (shadow - row) / SHADOW_BYTES_PER_BLOCK + 1;
386}
387
388static void print_shadow_for_address(const void *addr)
389{
390 int i;
391 const void *shadow = kasan_mem_to_shadow(addr);
392 const void *shadow_row;
393
394 shadow_row = (void *)round_down((unsigned long)shadow,
395 SHADOW_BYTES_PER_ROW)
396 - SHADOW_ROWS_AROUND_ADDR * SHADOW_BYTES_PER_ROW;
397
398 pr_err("Memory state around the buggy address:\n");
399
400 for (i = -SHADOW_ROWS_AROUND_ADDR; i <= SHADOW_ROWS_AROUND_ADDR; i++) {
401 const void *kaddr = kasan_shadow_to_mem(shadow_row);
402 char buffer[4 + (BITS_PER_LONG/8)*2];
403 char shadow_buf[SHADOW_BYTES_PER_ROW];
404
405 snprintf(buffer, sizeof(buffer),
406 (i == 0) ? ">%px: " : " %px: ", kaddr);
407
408
409
410
411
412 memcpy(shadow_buf, shadow_row, SHADOW_BYTES_PER_ROW);
413 print_hex_dump(KERN_ERR, buffer,
414 DUMP_PREFIX_NONE, SHADOW_BYTES_PER_ROW, 1,
415 shadow_buf, SHADOW_BYTES_PER_ROW, 0);
416
417 if (row_is_guilty(shadow_row, shadow))
418 pr_err("%*c\n",
419 shadow_pointer_offset(shadow_row, shadow),
420 '^');
421
422 shadow_row += SHADOW_BYTES_PER_ROW;
423 }
424}
425
426static bool report_enabled(void)
427{
428 if (current->kasan_depth)
429 return false;
430 if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
431 return true;
432 return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
433}
434
435void kasan_report_invalid_free(void *object, unsigned long ip)
436{
437 unsigned long flags;
438
439 start_report(&flags);
440 pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
441 print_tags(get_tag(object), reset_tag(object));
442 object = reset_tag(object);
443 pr_err("\n");
444 print_address_description(object);
445 pr_err("\n");
446 print_shadow_for_address(object);
447 end_report(&flags);
448}
449
450void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip)
451{
452 struct kasan_access_info info;
453 void *tagged_addr;
454 void *untagged_addr;
455 unsigned long flags;
456
457 if (likely(!report_enabled()))
458 return;
459
460 disable_trace_on_warning();
461
462 tagged_addr = (void *)addr;
463 untagged_addr = reset_tag(tagged_addr);
464
465 info.access_addr = tagged_addr;
466 if (addr_has_shadow(untagged_addr))
467 info.first_bad_addr = find_first_bad_addr(tagged_addr, size);
468 else
469 info.first_bad_addr = untagged_addr;
470 info.access_size = size;
471 info.is_write = is_write;
472 info.ip = ip;
473
474 start_report(&flags);
475
476 print_error_description(&info);
477 if (addr_has_shadow(untagged_addr))
478 print_tags(get_tag(tagged_addr), info.first_bad_addr);
479 pr_err("\n");
480
481 if (addr_has_shadow(untagged_addr)) {
482 print_address_description(untagged_addr);
483 pr_err("\n");
484 print_shadow_for_address(info.first_bad_addr);
485 } else {
486 dump_stack();
487 }
488
489 end_report(&flags);
490}
491