2020-12-22 20:02:10 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
/*
|
|
|
|
* This file contains core hardware tag-based KASAN code.
|
|
|
|
*
|
|
|
|
* Copyright (c) 2020 Google, Inc.
|
|
|
|
* Author: Andrey Konovalov <andreyknvl@google.com>
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define pr_fmt(fmt) "kasan: " fmt
|
|
|
|
|
2020-12-22 20:03:06 +00:00
|
|
|
#include <linux/init.h>
|
2020-12-22 20:02:10 +00:00
|
|
|
#include <linux/kasan.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/memory.h>
|
|
|
|
#include <linux/mm.h>
|
2020-12-22 20:03:06 +00:00
|
|
|
#include <linux/static_key.h>
|
2020-12-22 20:02:10 +00:00
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/types.h>
|
|
|
|
|
|
|
|
#include "kasan.h"
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
enum kasan_arg {
|
|
|
|
KASAN_ARG_DEFAULT,
|
|
|
|
KASAN_ARG_OFF,
|
|
|
|
KASAN_ARG_ON,
|
2020-12-22 20:03:06 +00:00
|
|
|
};
|
|
|
|
|
2021-03-15 13:20:12 +00:00
|
|
|
enum kasan_arg_mode {
|
|
|
|
KASAN_ARG_MODE_DEFAULT,
|
|
|
|
KASAN_ARG_MODE_SYNC,
|
|
|
|
KASAN_ARG_MODE_ASYNC,
|
2021-10-06 15:47:51 +00:00
|
|
|
KASAN_ARG_MODE_ASYMM,
|
2021-03-15 13:20:12 +00:00
|
|
|
};
|
|
|
|
|
2020-12-22 20:03:06 +00:00
|
|
|
enum kasan_arg_stacktrace {
|
|
|
|
KASAN_ARG_STACKTRACE_DEFAULT,
|
|
|
|
KASAN_ARG_STACKTRACE_OFF,
|
|
|
|
KASAN_ARG_STACKTRACE_ON,
|
|
|
|
};
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
static enum kasan_arg kasan_arg __ro_after_init;
|
2021-03-15 13:20:12 +00:00
|
|
|
static enum kasan_arg_mode kasan_arg_mode __ro_after_init;
|
2020-12-22 20:03:06 +00:00
|
|
|
static enum kasan_arg_stacktrace kasan_arg_stacktrace __ro_after_init;
|
|
|
|
|
|
|
|
/* Whether KASAN is enabled at all. */
|
|
|
|
DEFINE_STATIC_KEY_FALSE(kasan_flag_enabled);
|
|
|
|
EXPORT_SYMBOL(kasan_flag_enabled);
|
|
|
|
|
2021-10-06 15:47:51 +00:00
|
|
|
/* Whether the selected mode is synchronous/asynchronous/asymmetric.*/
|
|
|
|
enum kasan_mode kasan_mode __ro_after_init;
|
|
|
|
EXPORT_SYMBOL_GPL(kasan_mode);
|
2021-03-15 13:20:12 +00:00
|
|
|
|
2020-12-22 20:03:06 +00:00
|
|
|
/* Whether to collect alloc/free stack traces. */
|
|
|
|
DEFINE_STATIC_KEY_FALSE(kasan_flag_stacktrace);
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
/* kasan=off/on */
|
|
|
|
static int __init early_kasan_flag(char *arg)
|
2020-12-22 20:03:06 +00:00
|
|
|
{
|
|
|
|
if (!arg)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!strcmp(arg, "off"))
|
2021-01-24 05:01:34 +00:00
|
|
|
kasan_arg = KASAN_ARG_OFF;
|
|
|
|
else if (!strcmp(arg, "on"))
|
|
|
|
kasan_arg = KASAN_ARG_ON;
|
2020-12-22 20:03:06 +00:00
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
2021-01-24 05:01:34 +00:00
|
|
|
early_param("kasan", early_kasan_flag);
|
2020-12-22 20:03:06 +00:00
|
|
|
|
2021-10-06 15:47:51 +00:00
|
|
|
/* kasan.mode=sync/async/asymm */
|
2021-03-15 13:20:12 +00:00
|
|
|
static int __init early_kasan_mode(char *arg)
|
|
|
|
{
|
|
|
|
if (!arg)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!strcmp(arg, "sync"))
|
|
|
|
kasan_arg_mode = KASAN_ARG_MODE_SYNC;
|
|
|
|
else if (!strcmp(arg, "async"))
|
|
|
|
kasan_arg_mode = KASAN_ARG_MODE_ASYNC;
|
2021-10-06 15:47:51 +00:00
|
|
|
else if (!strcmp(arg, "asymm"))
|
|
|
|
kasan_arg_mode = KASAN_ARG_MODE_ASYMM;
|
2021-03-15 13:20:12 +00:00
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
early_param("kasan.mode", early_kasan_mode);
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
/* kasan.stacktrace=off/on */
|
2020-12-22 20:03:06 +00:00
|
|
|
static int __init early_kasan_flag_stacktrace(char *arg)
|
|
|
|
{
|
|
|
|
if (!arg)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!strcmp(arg, "off"))
|
|
|
|
kasan_arg_stacktrace = KASAN_ARG_STACKTRACE_OFF;
|
|
|
|
else if (!strcmp(arg, "on"))
|
|
|
|
kasan_arg_stacktrace = KASAN_ARG_STACKTRACE_ON;
|
|
|
|
else
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
early_param("kasan.stacktrace", early_kasan_flag_stacktrace);
|
|
|
|
|
2021-11-11 04:32:49 +00:00
|
|
|
static inline const char *kasan_mode_info(void)
|
|
|
|
{
|
|
|
|
if (kasan_mode == KASAN_MODE_ASYNC)
|
|
|
|
return "async";
|
|
|
|
else if (kasan_mode == KASAN_MODE_ASYMM)
|
|
|
|
return "asymm";
|
|
|
|
else
|
|
|
|
return "sync";
|
|
|
|
}
|
|
|
|
|
2020-12-22 20:02:10 +00:00
|
|
|
/* kasan_init_hw_tags_cpu() is called for each CPU. */
|
|
|
|
void kasan_init_hw_tags_cpu(void)
|
|
|
|
{
|
2020-12-22 20:03:06 +00:00
|
|
|
/*
|
|
|
|
* There's no need to check that the hardware is MTE-capable here,
|
|
|
|
* as this function is only called for MTE-capable hardware.
|
|
|
|
*/
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
/* If KASAN is disabled via command line, don't initialize it. */
|
|
|
|
if (kasan_arg == KASAN_ARG_OFF)
|
2020-12-22 20:03:06 +00:00
|
|
|
return;
|
|
|
|
|
2021-03-15 13:20:12 +00:00
|
|
|
/*
|
2021-10-06 15:47:51 +00:00
|
|
|
* Enable async or asymm modes only when explicitly requested
|
|
|
|
* through the command line.
|
2021-03-15 13:20:12 +00:00
|
|
|
*/
|
|
|
|
if (kasan_arg_mode == KASAN_ARG_MODE_ASYNC)
|
|
|
|
hw_enable_tagging_async();
|
2021-10-06 15:47:51 +00:00
|
|
|
else if (kasan_arg_mode == KASAN_ARG_MODE_ASYMM)
|
|
|
|
hw_enable_tagging_asymm();
|
2021-03-15 13:20:12 +00:00
|
|
|
else
|
|
|
|
hw_enable_tagging_sync();
|
2020-12-22 20:02:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* kasan_init_hw_tags() is called once on boot CPU. */
|
|
|
|
void __init kasan_init_hw_tags(void)
|
|
|
|
{
|
2021-01-24 05:01:34 +00:00
|
|
|
/* If hardware doesn't support MTE, don't initialize KASAN. */
|
2020-12-22 20:03:06 +00:00
|
|
|
if (!system_supports_mte())
|
|
|
|
return;
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
/* If KASAN is disabled via command line, don't initialize it. */
|
|
|
|
if (kasan_arg == KASAN_ARG_OFF)
|
2020-12-22 20:03:06 +00:00
|
|
|
return;
|
|
|
|
|
2021-01-24 05:01:34 +00:00
|
|
|
/* Enable KASAN. */
|
|
|
|
static_branch_enable(&kasan_flag_enabled);
|
2020-12-22 20:03:06 +00:00
|
|
|
|
2021-03-15 13:20:12 +00:00
|
|
|
switch (kasan_arg_mode) {
|
|
|
|
case KASAN_ARG_MODE_DEFAULT:
|
|
|
|
/*
|
|
|
|
* Default to sync mode.
|
|
|
|
*/
|
2021-10-06 15:47:51 +00:00
|
|
|
fallthrough;
|
2021-03-15 13:20:12 +00:00
|
|
|
case KASAN_ARG_MODE_SYNC:
|
2021-10-06 15:47:51 +00:00
|
|
|
/* Sync mode enabled. */
|
|
|
|
kasan_mode = KASAN_MODE_SYNC;
|
2021-03-15 13:20:12 +00:00
|
|
|
break;
|
|
|
|
case KASAN_ARG_MODE_ASYNC:
|
|
|
|
/* Async mode enabled. */
|
2021-10-06 15:47:51 +00:00
|
|
|
kasan_mode = KASAN_MODE_ASYNC;
|
|
|
|
break;
|
|
|
|
case KASAN_ARG_MODE_ASYMM:
|
|
|
|
/* Asymm mode enabled. */
|
|
|
|
kasan_mode = KASAN_MODE_ASYMM;
|
2021-03-15 13:20:12 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2020-12-22 20:03:06 +00:00
|
|
|
switch (kasan_arg_stacktrace) {
|
|
|
|
case KASAN_ARG_STACKTRACE_DEFAULT:
|
2021-02-09 21:42:03 +00:00
|
|
|
/* Default to enabling stack trace collection. */
|
|
|
|
static_branch_enable(&kasan_flag_stacktrace);
|
2020-12-22 20:03:06 +00:00
|
|
|
break;
|
|
|
|
case KASAN_ARG_STACKTRACE_OFF:
|
2021-01-24 05:01:34 +00:00
|
|
|
/* Do nothing, kasan_flag_stacktrace keeps its default value. */
|
2020-12-22 20:03:06 +00:00
|
|
|
break;
|
|
|
|
case KASAN_ARG_STACKTRACE_ON:
|
|
|
|
static_branch_enable(&kasan_flag_stacktrace);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2021-11-11 04:32:49 +00:00
|
|
|
pr_info("KernelAddressSanitizer initialized (hw-tags, mode=%s, stacktrace=%s)\n",
|
|
|
|
kasan_mode_info(),
|
|
|
|
kasan_stack_collection_enabled() ? "on" : "off");
|
2020-12-22 20:02:10 +00:00
|
|
|
}
|
|
|
|
|
2022-03-25 01:11:32 +00:00
|
|
|
#ifdef CONFIG_KASAN_VMALLOC
|
|
|
|
|
|
|
|
static void unpoison_vmalloc_pages(const void *addr, u8 tag)
|
|
|
|
{
|
|
|
|
struct vm_struct *area;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* As hardware tag-based KASAN only tags VM_ALLOC vmalloc allocations
|
|
|
|
* (see the comment in __kasan_unpoison_vmalloc), all of the pages
|
|
|
|
* should belong to a single area.
|
|
|
|
*/
|
|
|
|
area = find_vm_area((void *)addr);
|
|
|
|
if (WARN_ON(!area))
|
|
|
|
return;
|
|
|
|
|
|
|
|
for (i = 0; i < area->nr_pages; i++) {
|
|
|
|
struct page *page = area->pages[i];
|
|
|
|
|
|
|
|
page_kasan_tag_set(page, tag);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void *__kasan_unpoison_vmalloc(const void *start, unsigned long size,
|
|
|
|
kasan_vmalloc_flags_t flags)
|
|
|
|
{
|
|
|
|
u8 tag;
|
|
|
|
unsigned long redzone_start, redzone_size;
|
|
|
|
|
|
|
|
if (!is_vmalloc_or_module_addr(start))
|
|
|
|
return (void *)start;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Skip unpoisoning and assigning a pointer tag for non-VM_ALLOC
|
|
|
|
* mappings as:
|
|
|
|
*
|
|
|
|
* 1. Unlike the software KASAN modes, hardware tag-based KASAN only
|
|
|
|
* supports tagging physical memory. Therefore, it can only tag a
|
|
|
|
* single mapping of normal physical pages.
|
|
|
|
* 2. Hardware tag-based KASAN can only tag memory mapped with special
|
|
|
|
* mapping protection bits, see arch_vmalloc_pgprot_modify().
|
|
|
|
* As non-VM_ALLOC mappings can be mapped outside of vmalloc code,
|
|
|
|
* providing these bits would require tracking all non-VM_ALLOC
|
|
|
|
* mappers.
|
|
|
|
*
|
|
|
|
* Thus, for VM_ALLOC mappings, hardware tag-based KASAN only tags
|
|
|
|
* the first virtual mapping, which is created by vmalloc().
|
|
|
|
* Tagging the page_alloc memory backing that vmalloc() allocation is
|
|
|
|
* skipped, see ___GFP_SKIP_KASAN_UNPOISON.
|
|
|
|
*
|
|
|
|
* For non-VM_ALLOC allocations, page_alloc memory is tagged as usual.
|
|
|
|
*/
|
|
|
|
if (!(flags & KASAN_VMALLOC_VM_ALLOC))
|
|
|
|
return (void *)start;
|
|
|
|
|
|
|
|
tag = kasan_random_tag();
|
|
|
|
start = set_tag(start, tag);
|
|
|
|
|
|
|
|
/* Unpoison and initialize memory up to size. */
|
|
|
|
kasan_unpoison(start, size, flags & KASAN_VMALLOC_INIT);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Explicitly poison and initialize the in-page vmalloc() redzone.
|
|
|
|
* Unlike software KASAN modes, hardware tag-based KASAN doesn't
|
|
|
|
* unpoison memory when populating shadow for vmalloc() space.
|
|
|
|
*/
|
|
|
|
redzone_start = round_up((unsigned long)start + size,
|
|
|
|
KASAN_GRANULE_SIZE);
|
|
|
|
redzone_size = round_up(redzone_start, PAGE_SIZE) - redzone_start;
|
|
|
|
kasan_poison((void *)redzone_start, redzone_size, KASAN_TAG_INVALID,
|
|
|
|
flags & KASAN_VMALLOC_INIT);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Set per-page tag flags to allow accessing physical memory for the
|
|
|
|
* vmalloc() mapping through page_address(vmalloc_to_page()).
|
|
|
|
*/
|
|
|
|
unpoison_vmalloc_pages(start, tag);
|
|
|
|
|
|
|
|
return (void *)start;
|
|
|
|
}
|
|
|
|
|
|
|
|
void __kasan_poison_vmalloc(const void *start, unsigned long size)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* No tagging here.
|
|
|
|
* The physical pages backing the vmalloc() allocation are poisoned
|
|
|
|
* through the usual page_alloc paths.
|
|
|
|
*/
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
2021-02-24 20:05:26 +00:00
|
|
|
#if IS_ENABLED(CONFIG_KASAN_KUNIT_TEST)
|
|
|
|
|
2021-03-15 13:20:12 +00:00
|
|
|
void kasan_enable_tagging_sync(void)
|
2021-02-24 20:05:26 +00:00
|
|
|
{
|
2021-03-15 13:20:12 +00:00
|
|
|
hw_enable_tagging_sync();
|
2021-02-24 20:05:26 +00:00
|
|
|
}
|
2021-03-15 13:20:12 +00:00
|
|
|
EXPORT_SYMBOL_GPL(kasan_enable_tagging_sync);
|
2021-02-24 20:05:26 +00:00
|
|
|
|
2021-03-15 13:20:19 +00:00
|
|
|
void kasan_force_async_fault(void)
|
|
|
|
{
|
|
|
|
hw_force_async_tag_fault();
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(kasan_force_async_fault);
|
|
|
|
|
2021-02-24 20:05:26 +00:00
|
|
|
#endif
|