report.c 12.6 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
2
/*
3
 * This file contains common KASAN error reporting code.
4 5
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
6
 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
7
 *
8
 * Some code borrowed from https://github.com/xairy/kasan-prototype by
9
 *        Andrey Konovalov <andreyknvl@gmail.com>
10 11
 */

12
#include <linux/bitops.h>
13
#include <linux/ftrace.h>
14
#include <linux/init.h>
15 16 17 18 19
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/printk.h>
#include <linux/sched.h>
#include <linux/slab.h>
20
#include <linux/stackdepot.h>
21 22 23 24
#include <linux/stacktrace.h>
#include <linux/string.h>
#include <linux/types.h>
#include <linux/kasan.h>
25
#include <linux/module.h>
26
#include <linux/sched/task_stack.h>
27
#include <linux/uaccess.h>
28
#include <trace/events/error_report.h>
29

30 31
#include <asm/sections.h>

P
Patricia Alfonso 已提交
32 33
#include <kunit/test.h>

34
#include "kasan.h"
35
#include "../slab.h"
36

37
static unsigned long kasan_flags;
38

39 40
#define KASAN_BIT_REPORTED	0
#define KASAN_BIT_MULTI_SHOT	1
41

42
bool kasan_save_enable_multi_shot(void)
43
{
44
	return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
45
}
46
EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
47

48
void kasan_restore_multi_shot(bool enabled)
49
{
50 51
	if (!enabled)
		clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
52
}
53
EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
54

55
static int __init kasan_set_multi_shot(char *str)
A
Andrey Konovalov 已提交
56
{
57 58
	set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
	return 1;
A
Andrey Konovalov 已提交
59
}
60
__setup("kasan_multi_shot", kasan_set_multi_shot);
A
Andrey Konovalov 已提交
61

62
static void print_error_description(struct kasan_access_info *info)
63
{
A
Andrey Konovalov 已提交
64
	pr_err("BUG: KASAN: %s in %pS\n",
65
		kasan_get_bug_type(info), (void *)info->ip);
66 67 68 69 70 71 72 73
	if (info->access_size)
		pr_err("%s of size %zu at addr %px by task %s/%d\n",
			info->is_write ? "Write" : "Read", info->access_size,
			info->access_addr, current->comm, task_pid_nr(current));
	else
		pr_err("%s at addr %px by task %s/%d\n",
			info->is_write ? "Write" : "Read",
			info->access_addr, current->comm, task_pid_nr(current));
74 75
}

76 77
static DEFINE_SPINLOCK(report_lock);

78
static void start_report(unsigned long *flags)
79 80 81 82 83 84 85 86 87
{
	/*
	 * Make sure we don't end up in loop.
	 */
	kasan_disable_current();
	spin_lock_irqsave(&report_lock, *flags);
	pr_err("==================================================================\n");
}

88
static void end_report(unsigned long *flags, unsigned long addr)
89
{
90 91
	if (!kasan_async_mode_enabled())
		trace_error_report_end(ERROR_DETECTOR_KASAN, addr);
92 93 94
	pr_err("==================================================================\n");
	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
	spin_unlock_irqrestore(&report_lock, *flags);
95
	if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) {
96 97 98 99 100 101 102
		/*
		 * This thread may hit another WARN() in the panic path.
		 * Resetting this prevents additional WARN() from panicking the
		 * system on this thread.  Other threads are blocked by the
		 * panic_mutex in panic().
		 */
		panic_on_warn = 0;
D
Dmitry Vyukov 已提交
103
		panic("panic_on_warn set ...\n");
104
	}
105 106 107 108
#ifdef CONFIG_KASAN_HW_TAGS
	if (kasan_flag_panic)
		panic("kasan.fault=panic set ...\n");
#endif
109 110 111
	kasan_enable_current();
}

112 113 114 115 116 117 118 119 120
static void print_stack(depot_stack_handle_t stack)
{
	unsigned long *entries;
	unsigned int nr_entries;

	nr_entries = stack_depot_fetch(stack, &entries);
	stack_trace_print(entries, nr_entries, 0);
}

121
static void print_track(struct kasan_track *track, const char *prefix)
A
Alexander Potapenko 已提交
122
{
123
	pr_err("%s by task %u:\n", prefix, track->pid);
124
	if (track->stack) {
125
		print_stack(track->stack);
126 127 128
	} else {
		pr_err("(stack is not available)\n");
	}
A
Alexander Potapenko 已提交
129 130
}

131
struct page *kasan_addr_to_page(const void *addr)
132 133 134 135 136 137 138
{
	if ((addr >= (void *)PAGE_OFFSET) &&
			(addr < high_memory))
		return virt_to_head_page(addr);
	return NULL;
}

139 140
static void describe_object_addr(struct kmem_cache *cache, void *object,
				const void *addr)
A
Alexander Potapenko 已提交
141
{
142 143 144 145
	unsigned long access_addr = (unsigned long)addr;
	unsigned long object_addr = (unsigned long)object;
	const char *rel_type;
	int rel_bytes;
A
Alexander Potapenko 已提交
146

147
	pr_err("The buggy address belongs to the object at %px\n"
148 149
	       " which belongs to the cache %s of size %d\n",
		object, cache->name, cache->object_size);
150

151
	if (!addr)
A
Alexander Potapenko 已提交
152
		return;
153

154 155 156 157 158 159 160 161 162 163 164 165
	if (access_addr < object_addr) {
		rel_type = "to the left";
		rel_bytes = object_addr - access_addr;
	} else if (access_addr >= object_addr + cache->object_size) {
		rel_type = "to the right";
		rel_bytes = access_addr - (object_addr + cache->object_size);
	} else {
		rel_type = "inside";
		rel_bytes = access_addr - object_addr;
	}

	pr_err("The buggy address is located %d bytes %s of\n"
166
	       " %d-byte region [%px, %px)\n",
167 168 169 170
		rel_bytes, rel_type, cache->object_size, (void *)object_addr,
		(void *)(object_addr + cache->object_size));
}

171 172
static void describe_object_stacks(struct kmem_cache *cache, void *object,
					const void *addr, u8 tag)
173
{
174 175
	struct kasan_alloc_meta *alloc_meta;
	struct kasan_track *free_track;
176

177 178
	alloc_meta = kasan_get_alloc_meta(cache, object);
	if (alloc_meta) {
179
		print_track(&alloc_meta->alloc_track, "Allocated");
180
		pr_err("\n");
181 182 183 184 185 186 187
	}

	free_track = kasan_get_free_track(cache, object, tag);
	if (free_track) {
		print_track(free_track, "Freed");
		pr_err("\n");
	}
188 189

#ifdef CONFIG_KASAN_GENERIC
190 191 192 193 194 195
	if (!alloc_meta)
		return;
	if (alloc_meta->aux_stack[0]) {
		pr_err("Last potentially related work creation:\n");
		print_stack(alloc_meta->aux_stack[0]);
		pr_err("\n");
196
	}
197 198 199 200 201 202
	if (alloc_meta->aux_stack[1]) {
		pr_err("Second to last potentially related work creation:\n");
		print_stack(alloc_meta->aux_stack[1]);
		pr_err("\n");
	}
#endif
203
}
204

205 206 207 208 209
static void describe_object(struct kmem_cache *cache, void *object,
				const void *addr, u8 tag)
{
	if (kasan_stack_collection_enabled())
		describe_object_stacks(cache, object, addr, tag);
210
	describe_object_addr(cache, object, addr);
A
Alexander Potapenko 已提交
211 212
}

213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228
static inline bool kernel_or_module_addr(const void *addr)
{
	if (addr >= (void *)_stext && addr < (void *)_end)
		return true;
	if (is_module_address((unsigned long)addr))
		return true;
	return false;
}

static inline bool init_task_stack_addr(const void *addr)
{
	return addr >= (void *)&init_thread_union.stack &&
		(addr <= (void *)&init_thread_union.stack +
			sizeof(init_thread_union.stack));
}

229
static void print_address_description(void *addr, u8 tag)
230
{
231
	struct page *page = kasan_addr_to_page(addr);
232

233
	dump_stack();
234
	pr_err("\n");
235 236 237

	if (page && PageSlab(page)) {
		struct kmem_cache *cache = page->slab_cache;
238
		void *object = nearest_obj(cache, page,	addr);
239

240
		describe_object(cache, object, addr, tag);
241 242
	}

243 244 245 246 247 248 249 250
	if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) {
		pr_err("The buggy address belongs to the variable:\n");
		pr_err(" %pS\n", addr);
	}

	if (page) {
		pr_err("The buggy address belongs to the page:\n");
		dump_page(page, "kasan: bad access detected");
251
	}
252

253
	kasan_print_address_stack_frame(addr);
254 255
}

256
static bool meta_row_is_guilty(const void *row, const void *addr)
257
{
258
	return (row <= addr) && (addr < row + META_MEM_BYTES_PER_ROW);
259 260
}

261
static int meta_pointer_offset(const void *row, const void *addr)
262
{
263 264 265 266 267 268 269 270 271
	/*
	 * Memory state around the buggy address:
	 *  ff00ff00ff00ff00: 00 00 00 05 fe fe fe fe fe fe fe fe fe fe fe fe
	 *  ...
	 *
	 * The length of ">ff00ff00ff00ff00: " is
	 *    3 + (BITS_PER_LONG / 8) * 2 chars.
	 * The length of each granule metadata is 2 bytes
	 *    plus 1 byte for space.
272
	 */
273 274
	return 3 + (BITS_PER_LONG / 8) * 2 +
		(addr - row) / KASAN_GRANULE_SIZE * 3 + 1;
275 276
}

277
static void print_memory_metadata(const void *addr)
278 279
{
	int i;
280
	void *row;
281

282 283
	row = (void *)round_down((unsigned long)addr, META_MEM_BYTES_PER_ROW)
			- META_ROWS_AROUND_ADDR * META_MEM_BYTES_PER_ROW;
284 285 286

	pr_err("Memory state around the buggy address:\n");

287
	for (i = -META_ROWS_AROUND_ADDR; i <= META_ROWS_AROUND_ADDR; i++) {
288 289
		char buffer[4 + (BITS_PER_LONG / 8) * 2];
		char metadata[META_BYTES_PER_ROW];
290 291

		snprintf(buffer, sizeof(buffer),
292 293
				(i == 0) ? ">%px: " : " %px: ", row);

294 295 296 297 298
		/*
		 * We should not pass a shadow pointer to generic
		 * function, because generic functions may try to
		 * access kasan mapping for the passed address.
		 */
299
		kasan_metadata_fetch_row(&metadata[0], row);
300

301
		print_hex_dump(KERN_ERR, buffer,
302
			DUMP_PREFIX_NONE, META_BYTES_PER_ROW, 1,
303
			metadata, META_BYTES_PER_ROW, 0);
304

305 306
		if (meta_row_is_guilty(row, addr))
			pr_err("%*c\n", meta_pointer_offset(row, addr), '^');
307

308
		row += META_MEM_BYTES_PER_ROW;
309 310 311
	}
}

312
static bool report_enabled(void)
313
{
314
#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
315 316
	if (current->kasan_depth)
		return false;
317
#endif
318 319 320 321 322
	if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
		return true;
	return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
}

P
Patricia Alfonso 已提交
323 324 325 326 327 328 329 330 331 332 333 334 335 336
#if IS_ENABLED(CONFIG_KUNIT)
static void kasan_update_kunit_status(struct kunit *cur_test)
{
	struct kunit_resource *resource;
	struct kunit_kasan_expectation *kasan_data;

	resource = kunit_find_named_resource(cur_test, "kasan_data");

	if (!resource) {
		kunit_set_failure(cur_test);
		return;
	}

	kasan_data = (struct kunit_kasan_expectation *)resource->data;
337
	WRITE_ONCE(kasan_data->report_found, true);
P
Patricia Alfonso 已提交
338 339 340 341
	kunit_put_resource(resource);
}
#endif /* IS_ENABLED(CONFIG_KUNIT) */

342
void kasan_report_invalid_free(void *object, unsigned long ip)
343 344
{
	unsigned long flags;
345
	u8 tag = get_tag(object);
346

347
	object = kasan_reset_tag(object);
P
Patricia Alfonso 已提交
348 349 350 351 352 353

#if IS_ENABLED(CONFIG_KUNIT)
	if (current->kunit_test)
		kasan_update_kunit_status(current->kunit_test);
#endif /* IS_ENABLED(CONFIG_KUNIT) */

354
	start_report(&flags);
355
	pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
356
	kasan_print_tags(tag, object);
357
	pr_err("\n");
358
	print_address_description(object, tag);
359
	pr_err("\n");
360
	print_memory_metadata(object);
361
	end_report(&flags, (unsigned long)object);
362 363
}

364 365 366 367 368 369 370 371 372 373 374 375 376 377
#ifdef CONFIG_KASAN_HW_TAGS
void kasan_report_async(void)
{
	unsigned long flags;

	start_report(&flags);
	pr_err("BUG: KASAN: invalid-access\n");
	pr_err("Asynchronous mode enabled: no access details available\n");
	pr_err("\n");
	dump_stack();
	end_report(&flags, 0);
}
#endif /* CONFIG_KASAN_HW_TAGS */

378 379
static void __kasan_report(unsigned long addr, size_t size, bool is_write,
				unsigned long ip)
380 381
{
	struct kasan_access_info info;
382 383 384
	void *tagged_addr;
	void *untagged_addr;
	unsigned long flags;
385

P
Patricia Alfonso 已提交
386 387 388 389 390
#if IS_ENABLED(CONFIG_KUNIT)
	if (current->kunit_test)
		kasan_update_kunit_status(current->kunit_test);
#endif /* IS_ENABLED(CONFIG_KUNIT) */

391 392
	disable_trace_on_warning();

393
	tagged_addr = (void *)addr;
394
	untagged_addr = kasan_reset_tag(tagged_addr);
395 396

	info.access_addr = tagged_addr;
397
	if (addr_has_metadata(untagged_addr))
398 399
		info.first_bad_addr =
			kasan_find_first_bad_addr(tagged_addr, size);
400 401
	else
		info.first_bad_addr = untagged_addr;
402 403 404
	info.access_size = size;
	info.is_write = is_write;
	info.ip = ip;
405

406 407 408
	start_report(&flags);

	print_error_description(&info);
409
	if (addr_has_metadata(untagged_addr))
410
		kasan_print_tags(get_tag(tagged_addr), info.first_bad_addr);
411 412
	pr_err("\n");

413
	if (addr_has_metadata(untagged_addr)) {
414
		print_address_description(untagged_addr, get_tag(tagged_addr));
415
		pr_err("\n");
416
		print_memory_metadata(info.first_bad_addr);
417 418 419 420
	} else {
		dump_stack();
	}

421
	end_report(&flags, addr);
422
}
423

424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439
bool kasan_report(unsigned long addr, size_t size, bool is_write,
			unsigned long ip)
{
	unsigned long flags = user_access_save();
	bool ret = false;

	if (likely(report_enabled())) {
		__kasan_report(addr, size, is_write, ip);
		ret = true;
	}

	user_access_restore(flags);

	return ret;
}

440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475
#ifdef CONFIG_KASAN_INLINE
/*
 * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high
 * canonical half of the address space) cause out-of-bounds shadow memory reads
 * before the actual access. For addresses in the low canonical half of the
 * address space, as well as most non-canonical addresses, that out-of-bounds
 * shadow memory access lands in the non-canonical part of the address space.
 * Help the user figure out what the original bogus pointer was.
 */
void kasan_non_canonical_hook(unsigned long addr)
{
	unsigned long orig_addr;
	const char *bug_type;

	if (addr < KASAN_SHADOW_OFFSET)
		return;

	orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT;
	/*
	 * For faults near the shadow address for NULL, we can be fairly certain
	 * that this is a KASAN shadow memory access.
	 * For faults that correspond to shadow for low canonical addresses, we
	 * can still be pretty sure - that shadow region is a fairly narrow
	 * chunk of the non-canonical address space.
	 * But faults that look like shadow for non-canonical addresses are a
	 * really large chunk of the address space. In that case, we still
	 * print the decoded address, but make it clear that this is not
	 * necessarily what's actually going on.
	 */
	if (orig_addr < PAGE_SIZE)
		bug_type = "null-ptr-deref";
	else if (orig_addr < TASK_SIZE)
		bug_type = "probably user-memory-access";
	else
		bug_type = "maybe wild-memory-access";
	pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,
476
		 orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1);
477 478
}
#endif