mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
![Andrey Konovalov](/assets/img/avatar_default.png)
Patch series "kasan: HW_TAGS tests support and fixes", v4. This patchset adds support for running KASAN-KUnit tests with the hardware tag-based mode and also contains a few fixes. This patch (of 15): There's a number of internal KASAN functions that are used across multiple source code files and therefore aren't marked as static inline. To avoid littering the kernel function names list with generic function names, prefix all such KASAN functions with kasan_. As a part of this change: - Rename internal (un)poison_range() to kasan_(un)poison() (no _range) to avoid name collision with a public kasan_unpoison_range(). - Rename check_memory_region() to kasan_check_range(), as it's a more fitting name. Link: https://lkml.kernel.org/r/cover.1610733117.git.andreyknvl@google.com Link: https://linux-review.googlesource.com/id/I719cc93483d4ba288a634dba80ee6b7f2809cd26 Link: https://lkml.kernel.org/r/13777aedf8d3ebbf35891136e1f2287e2f34aaba.1610733117.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Suggested-by: Marco Elver <elver@google.com> Reviewed-by: Marco Elver <elver@google.com> Reviewed-by: Alexander Potapenko <glider@google.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Peter Collingbourne <pcc@google.com> Cc: Evgenii Stepanov <eugenis@google.com> Cc: Branislav Rankov <Branislav.Rankov@arm.com> Cc: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
327 lines
8.5 KiB
C
327 lines
8.5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* This file contains generic KASAN specific error reporting code.
|
|
*
|
|
* Copyright (c) 2014 Samsung Electronics Co., Ltd.
|
|
* Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
|
|
*
|
|
* Some code borrowed from https://github.com/xairy/kasan-prototype by
|
|
* Andrey Konovalov <andreyknvl@gmail.com>
|
|
*/
|
|
|
|
#include <linux/bitops.h>
|
|
#include <linux/ftrace.h>
|
|
#include <linux/init.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/printk.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/sched/task_stack.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/stackdepot.h>
|
|
#include <linux/stacktrace.h>
|
|
#include <linux/string.h>
|
|
#include <linux/types.h>
|
|
#include <linux/kasan.h>
|
|
#include <linux/module.h>
|
|
|
|
#include <asm/sections.h>
|
|
|
|
#include "kasan.h"
|
|
#include "../slab.h"
|
|
|
|
void *kasan_find_first_bad_addr(void *addr, size_t size)
|
|
{
|
|
void *p = addr;
|
|
|
|
while (p < addr + size && !(*(u8 *)kasan_mem_to_shadow(p)))
|
|
p += KASAN_GRANULE_SIZE;
|
|
return p;
|
|
}
|
|
|
|
static const char *get_shadow_bug_type(struct kasan_access_info *info)
|
|
{
|
|
const char *bug_type = "unknown-crash";
|
|
u8 *shadow_addr;
|
|
|
|
shadow_addr = (u8 *)kasan_mem_to_shadow(info->first_bad_addr);
|
|
|
|
/*
|
|
* If shadow byte value is in [0, KASAN_GRANULE_SIZE) we can look
|
|
* at the next shadow byte to determine the type of the bad access.
|
|
*/
|
|
if (*shadow_addr > 0 && *shadow_addr <= KASAN_GRANULE_SIZE - 1)
|
|
shadow_addr++;
|
|
|
|
switch (*shadow_addr) {
|
|
case 0 ... KASAN_GRANULE_SIZE - 1:
|
|
/*
|
|
* In theory it's still possible to see these shadow values
|
|
* due to a data race in the kernel code.
|
|
*/
|
|
bug_type = "out-of-bounds";
|
|
break;
|
|
case KASAN_PAGE_REDZONE:
|
|
case KASAN_KMALLOC_REDZONE:
|
|
bug_type = "slab-out-of-bounds";
|
|
break;
|
|
case KASAN_GLOBAL_REDZONE:
|
|
bug_type = "global-out-of-bounds";
|
|
break;
|
|
case KASAN_STACK_LEFT:
|
|
case KASAN_STACK_MID:
|
|
case KASAN_STACK_RIGHT:
|
|
case KASAN_STACK_PARTIAL:
|
|
bug_type = "stack-out-of-bounds";
|
|
break;
|
|
case KASAN_FREE_PAGE:
|
|
case KASAN_KMALLOC_FREE:
|
|
case KASAN_KMALLOC_FREETRACK:
|
|
bug_type = "use-after-free";
|
|
break;
|
|
case KASAN_ALLOCA_LEFT:
|
|
case KASAN_ALLOCA_RIGHT:
|
|
bug_type = "alloca-out-of-bounds";
|
|
break;
|
|
case KASAN_VMALLOC_INVALID:
|
|
bug_type = "vmalloc-out-of-bounds";
|
|
break;
|
|
}
|
|
|
|
return bug_type;
|
|
}
|
|
|
|
static const char *get_wild_bug_type(struct kasan_access_info *info)
|
|
{
|
|
const char *bug_type = "unknown-crash";
|
|
|
|
if ((unsigned long)info->access_addr < PAGE_SIZE)
|
|
bug_type = "null-ptr-deref";
|
|
else if ((unsigned long)info->access_addr < TASK_SIZE)
|
|
bug_type = "user-memory-access";
|
|
else
|
|
bug_type = "wild-memory-access";
|
|
|
|
return bug_type;
|
|
}
|
|
|
|
const char *kasan_get_bug_type(struct kasan_access_info *info)
|
|
{
|
|
/*
|
|
* If access_size is a negative number, then it has reason to be
|
|
* defined as out-of-bounds bug type.
|
|
*
|
|
* Casting negative numbers to size_t would indeed turn up as
|
|
* a large size_t and its value will be larger than ULONG_MAX/2,
|
|
* so that this can qualify as out-of-bounds.
|
|
*/
|
|
if (info->access_addr + info->access_size < info->access_addr)
|
|
return "out-of-bounds";
|
|
|
|
if (addr_has_metadata(info->access_addr))
|
|
return get_shadow_bug_type(info);
|
|
return get_wild_bug_type(info);
|
|
}
|
|
|
|
void kasan_metadata_fetch_row(char *buffer, void *row)
|
|
{
|
|
memcpy(buffer, kasan_mem_to_shadow(row), META_BYTES_PER_ROW);
|
|
}
|
|
|
|
#if CONFIG_KASAN_STACK
|
|
static bool __must_check tokenize_frame_descr(const char **frame_descr,
|
|
char *token, size_t max_tok_len,
|
|
unsigned long *value)
|
|
{
|
|
const char *sep = strchr(*frame_descr, ' ');
|
|
|
|
if (sep == NULL)
|
|
sep = *frame_descr + strlen(*frame_descr);
|
|
|
|
if (token != NULL) {
|
|
const size_t tok_len = sep - *frame_descr;
|
|
|
|
if (tok_len + 1 > max_tok_len) {
|
|
pr_err("KASAN internal error: frame description too long: %s\n",
|
|
*frame_descr);
|
|
return false;
|
|
}
|
|
|
|
/* Copy token (+ 1 byte for '\0'). */
|
|
strlcpy(token, *frame_descr, tok_len + 1);
|
|
}
|
|
|
|
/* Advance frame_descr past separator. */
|
|
*frame_descr = sep + 1;
|
|
|
|
if (value != NULL && kstrtoul(token, 10, value)) {
|
|
pr_err("KASAN internal error: not a valid number: %s\n", token);
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
static void print_decoded_frame_descr(const char *frame_descr)
|
|
{
|
|
/*
|
|
* We need to parse the following string:
|
|
* "n alloc_1 alloc_2 ... alloc_n"
|
|
* where alloc_i looks like
|
|
* "offset size len name"
|
|
* or "offset size len name:line".
|
|
*/
|
|
|
|
char token[64];
|
|
unsigned long num_objects;
|
|
|
|
if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
|
|
&num_objects))
|
|
return;
|
|
|
|
pr_err("\n");
|
|
pr_err("this frame has %lu %s:\n", num_objects,
|
|
num_objects == 1 ? "object" : "objects");
|
|
|
|
while (num_objects--) {
|
|
unsigned long offset;
|
|
unsigned long size;
|
|
|
|
/* access offset */
|
|
if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
|
|
&offset))
|
|
return;
|
|
/* access size */
|
|
if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
|
|
&size))
|
|
return;
|
|
/* name length (unused) */
|
|
if (!tokenize_frame_descr(&frame_descr, NULL, 0, NULL))
|
|
return;
|
|
/* object name */
|
|
if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
|
|
NULL))
|
|
return;
|
|
|
|
/* Strip line number; without filename it's not very helpful. */
|
|
strreplace(token, ':', '\0');
|
|
|
|
/* Finally, print object information. */
|
|
pr_err(" [%lu, %lu) '%s'", offset, offset + size, token);
|
|
}
|
|
}
|
|
|
|
static bool __must_check get_address_stack_frame_info(const void *addr,
|
|
unsigned long *offset,
|
|
const char **frame_descr,
|
|
const void **frame_pc)
|
|
{
|
|
unsigned long aligned_addr;
|
|
unsigned long mem_ptr;
|
|
const u8 *shadow_bottom;
|
|
const u8 *shadow_ptr;
|
|
const unsigned long *frame;
|
|
|
|
BUILD_BUG_ON(IS_ENABLED(CONFIG_STACK_GROWSUP));
|
|
|
|
/*
|
|
* NOTE: We currently only support printing frame information for
|
|
* accesses to the task's own stack.
|
|
*/
|
|
if (!object_is_on_stack(addr))
|
|
return false;
|
|
|
|
aligned_addr = round_down((unsigned long)addr, sizeof(long));
|
|
mem_ptr = round_down(aligned_addr, KASAN_GRANULE_SIZE);
|
|
shadow_ptr = kasan_mem_to_shadow((void *)aligned_addr);
|
|
shadow_bottom = kasan_mem_to_shadow(end_of_stack(current));
|
|
|
|
while (shadow_ptr >= shadow_bottom && *shadow_ptr != KASAN_STACK_LEFT) {
|
|
shadow_ptr--;
|
|
mem_ptr -= KASAN_GRANULE_SIZE;
|
|
}
|
|
|
|
while (shadow_ptr >= shadow_bottom && *shadow_ptr == KASAN_STACK_LEFT) {
|
|
shadow_ptr--;
|
|
mem_ptr -= KASAN_GRANULE_SIZE;
|
|
}
|
|
|
|
if (shadow_ptr < shadow_bottom)
|
|
return false;
|
|
|
|
frame = (const unsigned long *)(mem_ptr + KASAN_GRANULE_SIZE);
|
|
if (frame[0] != KASAN_CURRENT_STACK_FRAME_MAGIC) {
|
|
pr_err("KASAN internal error: frame info validation failed; invalid marker: %lu\n",
|
|
frame[0]);
|
|
return false;
|
|
}
|
|
|
|
*offset = (unsigned long)addr - (unsigned long)frame;
|
|
*frame_descr = (const char *)frame[1];
|
|
*frame_pc = (void *)frame[2];
|
|
|
|
return true;
|
|
}
|
|
|
|
void kasan_print_address_stack_frame(const void *addr)
|
|
{
|
|
unsigned long offset;
|
|
const char *frame_descr;
|
|
const void *frame_pc;
|
|
|
|
if (!get_address_stack_frame_info(addr, &offset, &frame_descr,
|
|
&frame_pc))
|
|
return;
|
|
|
|
/*
|
|
* get_address_stack_frame_info only returns true if the given addr is
|
|
* on the current task's stack.
|
|
*/
|
|
pr_err("\n");
|
|
pr_err("addr %px is located in stack of task %s/%d at offset %lu in frame:\n",
|
|
addr, current->comm, task_pid_nr(current), offset);
|
|
pr_err(" %pS\n", frame_pc);
|
|
|
|
if (!frame_descr)
|
|
return;
|
|
|
|
print_decoded_frame_descr(frame_descr);
|
|
}
|
|
#endif /* CONFIG_KASAN_STACK */
|
|
|
|
#define DEFINE_ASAN_REPORT_LOAD(size) \
|
|
void __asan_report_load##size##_noabort(unsigned long addr) \
|
|
{ \
|
|
kasan_report(addr, size, false, _RET_IP_); \
|
|
} \
|
|
EXPORT_SYMBOL(__asan_report_load##size##_noabort)
|
|
|
|
#define DEFINE_ASAN_REPORT_STORE(size) \
|
|
void __asan_report_store##size##_noabort(unsigned long addr) \
|
|
{ \
|
|
kasan_report(addr, size, true, _RET_IP_); \
|
|
} \
|
|
EXPORT_SYMBOL(__asan_report_store##size##_noabort)
|
|
|
|
DEFINE_ASAN_REPORT_LOAD(1);
|
|
DEFINE_ASAN_REPORT_LOAD(2);
|
|
DEFINE_ASAN_REPORT_LOAD(4);
|
|
DEFINE_ASAN_REPORT_LOAD(8);
|
|
DEFINE_ASAN_REPORT_LOAD(16);
|
|
DEFINE_ASAN_REPORT_STORE(1);
|
|
DEFINE_ASAN_REPORT_STORE(2);
|
|
DEFINE_ASAN_REPORT_STORE(4);
|
|
DEFINE_ASAN_REPORT_STORE(8);
|
|
DEFINE_ASAN_REPORT_STORE(16);
|
|
|
|
void __asan_report_load_n_noabort(unsigned long addr, size_t size)
|
|
{
|
|
kasan_report(addr, size, false, _RET_IP_);
|
|
}
|
|
EXPORT_SYMBOL(__asan_report_load_n_noabort);
|
|
|
|
void __asan_report_store_n_noabort(unsigned long addr, size_t size)
|
|
{
|
|
kasan_report(addr, size, true, _RET_IP_);
|
|
}
|
|
EXPORT_SYMBOL(__asan_report_store_n_noabort);
|