]>
Commit | Line | Data |
---|---|---|
0b24becc AR |
1 | /* |
2 | * This file contains shadow memory manipulation code. | |
3 | * | |
4 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. | |
2baf9e89 | 5 | * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> |
0b24becc | 6 | * |
5d0926ef | 7 | * Some code borrowed from https://github.com/xairy/kasan-prototype by |
5f21f3a8 | 8 | * Andrey Konovalov <andreyknvl@gmail.com> |
0b24becc AR |
9 | * |
10 | * This program is free software; you can redistribute it and/or modify | |
11 | * it under the terms of the GNU General Public License version 2 as | |
12 | * published by the Free Software Foundation. | |
13 | * | |
14 | */ | |
15 | ||
16 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
17 | #define DISABLE_BRANCH_PROFILING | |
18 | ||
19 | #include <linux/export.h> | |
cd11016e | 20 | #include <linux/interrupt.h> |
0b24becc | 21 | #include <linux/init.h> |
cd11016e | 22 | #include <linux/kasan.h> |
0b24becc | 23 | #include <linux/kernel.h> |
45937254 | 24 | #include <linux/kmemleak.h> |
e3ae1163 | 25 | #include <linux/linkage.h> |
0b24becc | 26 | #include <linux/memblock.h> |
786a8959 | 27 | #include <linux/memory.h> |
0b24becc | 28 | #include <linux/mm.h> |
bebf56a1 | 29 | #include <linux/module.h> |
0b24becc AR |
30 | #include <linux/printk.h> |
31 | #include <linux/sched.h> | |
68db0cf1 | 32 | #include <linux/sched/task_stack.h> |
0b24becc AR |
33 | #include <linux/slab.h> |
34 | #include <linux/stacktrace.h> | |
35 | #include <linux/string.h> | |
36 | #include <linux/types.h> | |
a5af5aa8 | 37 | #include <linux/vmalloc.h> |
9f7d416c | 38 | #include <linux/bug.h> |
0b24becc AR |
39 | |
40 | #include "kasan.h" | |
0316bec2 | 41 | #include "../slab.h" |
0b24becc | 42 | |
af8601ad IM |
43 | void kasan_enable_current(void) |
44 | { | |
45 | current->kasan_depth++; | |
46 | } | |
47 | ||
48 | void kasan_disable_current(void) | |
49 | { | |
50 | current->kasan_depth--; | |
51 | } | |
52 | ||
0b24becc AR |
53 | /* |
54 | * Poisons the shadow memory for 'size' bytes starting from 'addr'. | |
55 | * Memory addresses should be aligned to KASAN_SHADOW_SCALE_SIZE. | |
56 | */ | |
57 | static void kasan_poison_shadow(const void *address, size_t size, u8 value) | |
58 | { | |
59 | void *shadow_start, *shadow_end; | |
60 | ||
61 | shadow_start = kasan_mem_to_shadow(address); | |
62 | shadow_end = kasan_mem_to_shadow(address + size); | |
63 | ||
64 | memset(shadow_start, value, shadow_end - shadow_start); | |
65 | } | |
66 | ||
67 | void kasan_unpoison_shadow(const void *address, size_t size) | |
68 | { | |
69 | kasan_poison_shadow(address, size, 0); | |
70 | ||
71 | if (size & KASAN_SHADOW_MASK) { | |
72 | u8 *shadow = (u8 *)kasan_mem_to_shadow(address + size); | |
73 | *shadow = size & KASAN_SHADOW_MASK; | |
74 | } | |
75 | } | |
76 | ||
9f7d416c | 77 | static void __kasan_unpoison_stack(struct task_struct *task, const void *sp) |
e3ae1163 MR |
78 | { |
79 | void *base = task_stack_page(task); | |
80 | size_t size = sp - base; | |
81 | ||
82 | kasan_unpoison_shadow(base, size); | |
83 | } | |
84 | ||
85 | /* Unpoison the entire stack for a task. */ | |
86 | void kasan_unpoison_task_stack(struct task_struct *task) | |
87 | { | |
88 | __kasan_unpoison_stack(task, task_stack_page(task) + THREAD_SIZE); | |
89 | } | |
90 | ||
91 | /* Unpoison the stack for the current task beyond a watermark sp value. */ | |
9f7d416c | 92 | asmlinkage void kasan_unpoison_task_stack_below(const void *watermark) |
e3ae1163 | 93 | { |
b53f40db JP |
94 | /* |
95 | * Calculate the task stack base address. Avoid using 'current' | |
96 | * because this function is called by early resume code which hasn't | |
97 | * yet set up the percpu register (%gs). | |
98 | */ | |
99 | void *base = (void *)((unsigned long)watermark & ~(THREAD_SIZE - 1)); | |
100 | ||
101 | kasan_unpoison_shadow(base, watermark - base); | |
9f7d416c DV |
102 | } |
103 | ||
104 | /* | |
105 | * Clear all poison for the region between the current SP and a provided | |
106 | * watermark value, as is sometimes required prior to hand-crafted asm function | |
107 | * returns in the middle of functions. | |
108 | */ | |
109 | void kasan_unpoison_stack_above_sp_to(const void *watermark) | |
110 | { | |
111 | const void *sp = __builtin_frame_address(0); | |
112 | size_t size = watermark - sp; | |
113 | ||
114 | if (WARN_ON(sp > watermark)) | |
115 | return; | |
116 | kasan_unpoison_shadow(sp, size); | |
e3ae1163 | 117 | } |
0b24becc AR |
118 | |
119 | /* | |
120 | * All functions below always inlined so compiler could | |
121 | * perform better optimizations in each of __asan_loadX/__assn_storeX | |
122 | * depending on memory access size X. | |
123 | */ | |
124 | ||
125 | static __always_inline bool memory_is_poisoned_1(unsigned long addr) | |
126 | { | |
127 | s8 shadow_value = *(s8 *)kasan_mem_to_shadow((void *)addr); | |
128 | ||
129 | if (unlikely(shadow_value)) { | |
130 | s8 last_accessible_byte = addr & KASAN_SHADOW_MASK; | |
131 | return unlikely(last_accessible_byte >= shadow_value); | |
132 | } | |
133 | ||
134 | return false; | |
135 | } | |
136 | ||
c634d807 AR |
137 | static __always_inline bool memory_is_poisoned_2_4_8(unsigned long addr, |
138 | unsigned long size) | |
0b24becc | 139 | { |
c634d807 | 140 | u8 *shadow_addr = (u8 *)kasan_mem_to_shadow((void *)addr); |
0b24becc | 141 | |
c634d807 AR |
142 | /* |
143 | * Access crosses 8(shadow size)-byte boundary. Such access maps | |
144 | * into 2 shadow bytes, so we need to check them both. | |
145 | */ | |
146 | if (unlikely(((addr + size - 1) & KASAN_SHADOW_MASK) < size - 1)) | |
147 | return *shadow_addr || memory_is_poisoned_1(addr + size - 1); | |
0b24becc | 148 | |
c634d807 | 149 | return memory_is_poisoned_1(addr + size - 1); |
0b24becc AR |
150 | } |
151 | ||
152 | static __always_inline bool memory_is_poisoned_16(unsigned long addr) | |
153 | { | |
c634d807 | 154 | u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr); |
0b24becc | 155 | |
c634d807 AR |
156 | /* Unaligned 16-bytes access maps into 3 shadow bytes. */ |
157 | if (unlikely(!IS_ALIGNED(addr, KASAN_SHADOW_SCALE_SIZE))) | |
158 | return *shadow_addr || memory_is_poisoned_1(addr + 15); | |
0b24becc | 159 | |
c634d807 | 160 | return *shadow_addr; |
0b24becc AR |
161 | } |
162 | ||
f5bd62cd | 163 | static __always_inline unsigned long bytes_is_nonzero(const u8 *start, |
0b24becc AR |
164 | size_t size) |
165 | { | |
166 | while (size) { | |
167 | if (unlikely(*start)) | |
168 | return (unsigned long)start; | |
169 | start++; | |
170 | size--; | |
171 | } | |
172 | ||
173 | return 0; | |
174 | } | |
175 | ||
f5bd62cd | 176 | static __always_inline unsigned long memory_is_nonzero(const void *start, |
0b24becc AR |
177 | const void *end) |
178 | { | |
179 | unsigned int words; | |
180 | unsigned long ret; | |
181 | unsigned int prefix = (unsigned long)start % 8; | |
182 | ||
183 | if (end - start <= 16) | |
f5bd62cd | 184 | return bytes_is_nonzero(start, end - start); |
0b24becc AR |
185 | |
186 | if (prefix) { | |
187 | prefix = 8 - prefix; | |
f5bd62cd | 188 | ret = bytes_is_nonzero(start, prefix); |
0b24becc AR |
189 | if (unlikely(ret)) |
190 | return ret; | |
191 | start += prefix; | |
192 | } | |
193 | ||
194 | words = (end - start) / 8; | |
195 | while (words) { | |
196 | if (unlikely(*(u64 *)start)) | |
f5bd62cd | 197 | return bytes_is_nonzero(start, 8); |
0b24becc AR |
198 | start += 8; |
199 | words--; | |
200 | } | |
201 | ||
f5bd62cd | 202 | return bytes_is_nonzero(start, (end - start) % 8); |
0b24becc AR |
203 | } |
204 | ||
205 | static __always_inline bool memory_is_poisoned_n(unsigned long addr, | |
206 | size_t size) | |
207 | { | |
208 | unsigned long ret; | |
209 | ||
f5bd62cd | 210 | ret = memory_is_nonzero(kasan_mem_to_shadow((void *)addr), |
0b24becc AR |
211 | kasan_mem_to_shadow((void *)addr + size - 1) + 1); |
212 | ||
213 | if (unlikely(ret)) { | |
214 | unsigned long last_byte = addr + size - 1; | |
215 | s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); | |
216 | ||
217 | if (unlikely(ret != (unsigned long)last_shadow || | |
e0d57714 | 218 | ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) |
0b24becc AR |
219 | return true; |
220 | } | |
221 | return false; | |
222 | } | |
223 | ||
224 | static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size) | |
225 | { | |
226 | if (__builtin_constant_p(size)) { | |
227 | switch (size) { | |
228 | case 1: | |
229 | return memory_is_poisoned_1(addr); | |
230 | case 2: | |
0b24becc | 231 | case 4: |
0b24becc | 232 | case 8: |
c634d807 | 233 | return memory_is_poisoned_2_4_8(addr, size); |
0b24becc AR |
234 | case 16: |
235 | return memory_is_poisoned_16(addr); | |
236 | default: | |
237 | BUILD_BUG(); | |
238 | } | |
239 | } | |
240 | ||
241 | return memory_is_poisoned_n(addr, size); | |
242 | } | |
243 | ||
936bb4bb AR |
244 | static __always_inline void check_memory_region_inline(unsigned long addr, |
245 | size_t size, bool write, | |
246 | unsigned long ret_ip) | |
0b24becc | 247 | { |
0b24becc AR |
248 | if (unlikely(size == 0)) |
249 | return; | |
250 | ||
251 | if (unlikely((void *)addr < | |
252 | kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) { | |
936bb4bb | 253 | kasan_report(addr, size, write, ret_ip); |
0b24becc AR |
254 | return; |
255 | } | |
256 | ||
257 | if (likely(!memory_is_poisoned(addr, size))) | |
258 | return; | |
259 | ||
936bb4bb | 260 | kasan_report(addr, size, write, ret_ip); |
0b24becc AR |
261 | } |
262 | ||
936bb4bb AR |
263 | static void check_memory_region(unsigned long addr, |
264 | size_t size, bool write, | |
265 | unsigned long ret_ip) | |
266 | { | |
267 | check_memory_region_inline(addr, size, write, ret_ip); | |
268 | } | |
393f203f | 269 | |
f06e8c58 | 270 | void kasan_check_read(const volatile void *p, unsigned int size) |
64f8ebaf AR |
271 | { |
272 | check_memory_region((unsigned long)p, size, false, _RET_IP_); | |
273 | } | |
274 | EXPORT_SYMBOL(kasan_check_read); | |
275 | ||
f06e8c58 | 276 | void kasan_check_write(const volatile void *p, unsigned int size) |
64f8ebaf AR |
277 | { |
278 | check_memory_region((unsigned long)p, size, true, _RET_IP_); | |
279 | } | |
280 | EXPORT_SYMBOL(kasan_check_write); | |
281 | ||
393f203f AR |
282 | #undef memset |
283 | void *memset(void *addr, int c, size_t len) | |
284 | { | |
936bb4bb | 285 | check_memory_region((unsigned long)addr, len, true, _RET_IP_); |
393f203f AR |
286 | |
287 | return __memset(addr, c, len); | |
288 | } | |
289 | ||
290 | #undef memmove | |
291 | void *memmove(void *dest, const void *src, size_t len) | |
292 | { | |
936bb4bb AR |
293 | check_memory_region((unsigned long)src, len, false, _RET_IP_); |
294 | check_memory_region((unsigned long)dest, len, true, _RET_IP_); | |
393f203f AR |
295 | |
296 | return __memmove(dest, src, len); | |
297 | } | |
298 | ||
299 | #undef memcpy | |
300 | void *memcpy(void *dest, const void *src, size_t len) | |
301 | { | |
936bb4bb AR |
302 | check_memory_region((unsigned long)src, len, false, _RET_IP_); |
303 | check_memory_region((unsigned long)dest, len, true, _RET_IP_); | |
393f203f AR |
304 | |
305 | return __memcpy(dest, src, len); | |
306 | } | |
307 | ||
b8c73fc2 AR |
308 | void kasan_alloc_pages(struct page *page, unsigned int order) |
309 | { | |
310 | if (likely(!PageHighMem(page))) | |
311 | kasan_unpoison_shadow(page_address(page), PAGE_SIZE << order); | |
312 | } | |
313 | ||
314 | void kasan_free_pages(struct page *page, unsigned int order) | |
315 | { | |
316 | if (likely(!PageHighMem(page))) | |
317 | kasan_poison_shadow(page_address(page), | |
318 | PAGE_SIZE << order, | |
319 | KASAN_FREE_PAGE); | |
320 | } | |
321 | ||
7ed2f9e6 AP |
322 | /* |
323 | * Adaptive redzone policy taken from the userspace AddressSanitizer runtime. | |
324 | * For larger allocations larger redzones are used. | |
325 | */ | |
be4a7988 | 326 | static unsigned int optimal_redzone(unsigned int object_size) |
7ed2f9e6 | 327 | { |
be4a7988 | 328 | return |
7ed2f9e6 AP |
329 | object_size <= 64 - 16 ? 16 : |
330 | object_size <= 128 - 32 ? 32 : | |
331 | object_size <= 512 - 64 ? 64 : | |
332 | object_size <= 4096 - 128 ? 128 : | |
333 | object_size <= (1 << 14) - 256 ? 256 : | |
334 | object_size <= (1 << 15) - 512 ? 512 : | |
335 | object_size <= (1 << 16) - 1024 ? 1024 : 2048; | |
7ed2f9e6 AP |
336 | } |
337 | ||
be4a7988 | 338 | void kasan_cache_create(struct kmem_cache *cache, unsigned int *size, |
d50112ed | 339 | slab_flags_t *flags) |
7ed2f9e6 | 340 | { |
be4a7988 | 341 | unsigned int orig_size = *size; |
7ed2f9e6 | 342 | int redzone_adjust; |
80a9201a | 343 | |
7ed2f9e6 AP |
344 | /* Add alloc meta. */ |
345 | cache->kasan_info.alloc_meta_offset = *size; | |
346 | *size += sizeof(struct kasan_alloc_meta); | |
347 | ||
348 | /* Add free meta. */ | |
5f0d5a3a | 349 | if (cache->flags & SLAB_TYPESAFE_BY_RCU || cache->ctor || |
7ed2f9e6 AP |
350 | cache->object_size < sizeof(struct kasan_free_meta)) { |
351 | cache->kasan_info.free_meta_offset = *size; | |
352 | *size += sizeof(struct kasan_free_meta); | |
353 | } | |
354 | redzone_adjust = optimal_redzone(cache->object_size) - | |
355 | (*size - cache->object_size); | |
80a9201a | 356 | |
7ed2f9e6 AP |
357 | if (redzone_adjust > 0) |
358 | *size += redzone_adjust; | |
80a9201a | 359 | |
be4a7988 AD |
360 | *size = min_t(unsigned int, KMALLOC_MAX_SIZE, |
361 | max(*size, cache->object_size + | |
80a9201a AP |
362 | optimal_redzone(cache->object_size))); |
363 | ||
364 | /* | |
365 | * If the metadata doesn't fit, don't enable KASAN at all. | |
366 | */ | |
367 | if (*size <= cache->kasan_info.alloc_meta_offset || | |
368 | *size <= cache->kasan_info.free_meta_offset) { | |
369 | cache->kasan_info.alloc_meta_offset = 0; | |
370 | cache->kasan_info.free_meta_offset = 0; | |
371 | *size = orig_size; | |
372 | return; | |
373 | } | |
374 | ||
375 | *flags |= SLAB_KASAN; | |
7ed2f9e6 | 376 | } |
7ed2f9e6 | 377 | |
55834c59 AP |
378 | void kasan_cache_shrink(struct kmem_cache *cache) |
379 | { | |
380 | quarantine_remove_cache(cache); | |
381 | } | |
382 | ||
f9fa1d91 | 383 | void kasan_cache_shutdown(struct kmem_cache *cache) |
55834c59 | 384 | { |
f9e13c0a SB |
385 | if (!__kmem_cache_empty(cache)) |
386 | quarantine_remove_cache(cache); | |
55834c59 AP |
387 | } |
388 | ||
80a9201a AP |
389 | size_t kasan_metadata_size(struct kmem_cache *cache) |
390 | { | |
391 | return (cache->kasan_info.alloc_meta_offset ? | |
392 | sizeof(struct kasan_alloc_meta) : 0) + | |
393 | (cache->kasan_info.free_meta_offset ? | |
394 | sizeof(struct kasan_free_meta) : 0); | |
395 | } | |
396 | ||
0316bec2 AR |
397 | void kasan_poison_slab(struct page *page) |
398 | { | |
399 | kasan_poison_shadow(page_address(page), | |
400 | PAGE_SIZE << compound_order(page), | |
401 | KASAN_KMALLOC_REDZONE); | |
402 | } | |
403 | ||
404 | void kasan_unpoison_object_data(struct kmem_cache *cache, void *object) | |
405 | { | |
406 | kasan_unpoison_shadow(object, cache->object_size); | |
407 | } | |
408 | ||
409 | void kasan_poison_object_data(struct kmem_cache *cache, void *object) | |
410 | { | |
411 | kasan_poison_shadow(object, | |
412 | round_up(cache->object_size, KASAN_SHADOW_SCALE_SIZE), | |
413 | KASAN_KMALLOC_REDZONE); | |
414 | } | |
415 | ||
cd11016e AP |
416 | static inline int in_irqentry_text(unsigned long ptr) |
417 | { | |
418 | return (ptr >= (unsigned long)&__irqentry_text_start && | |
419 | ptr < (unsigned long)&__irqentry_text_end) || | |
420 | (ptr >= (unsigned long)&__softirqentry_text_start && | |
421 | ptr < (unsigned long)&__softirqentry_text_end); | |
422 | } | |
423 | ||
424 | static inline void filter_irq_stacks(struct stack_trace *trace) | |
425 | { | |
426 | int i; | |
427 | ||
428 | if (!trace->nr_entries) | |
429 | return; | |
430 | for (i = 0; i < trace->nr_entries; i++) | |
431 | if (in_irqentry_text(trace->entries[i])) { | |
432 | /* Include the irqentry function into the stack. */ | |
433 | trace->nr_entries = i + 1; | |
434 | break; | |
435 | } | |
436 | } | |
437 | ||
438 | static inline depot_stack_handle_t save_stack(gfp_t flags) | |
439 | { | |
440 | unsigned long entries[KASAN_STACK_DEPTH]; | |
441 | struct stack_trace trace = { | |
442 | .nr_entries = 0, | |
443 | .entries = entries, | |
444 | .max_entries = KASAN_STACK_DEPTH, | |
445 | .skip = 0 | |
446 | }; | |
447 | ||
448 | save_stack_trace(&trace); | |
449 | filter_irq_stacks(&trace); | |
450 | if (trace.nr_entries != 0 && | |
451 | trace.entries[trace.nr_entries-1] == ULONG_MAX) | |
452 | trace.nr_entries--; | |
453 | ||
454 | return depot_save_stack(&trace, flags); | |
455 | } | |
456 | ||
457 | static inline void set_track(struct kasan_track *track, gfp_t flags) | |
7ed2f9e6 | 458 | { |
7ed2f9e6 | 459 | track->pid = current->pid; |
cd11016e | 460 | track->stack = save_stack(flags); |
7ed2f9e6 AP |
461 | } |
462 | ||
7ed2f9e6 AP |
463 | struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, |
464 | const void *object) | |
465 | { | |
cd11016e | 466 | BUILD_BUG_ON(sizeof(struct kasan_alloc_meta) > 32); |
7ed2f9e6 AP |
467 | return (void *)object + cache->kasan_info.alloc_meta_offset; |
468 | } | |
469 | ||
470 | struct kasan_free_meta *get_free_info(struct kmem_cache *cache, | |
471 | const void *object) | |
472 | { | |
cd11016e | 473 | BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32); |
7ed2f9e6 AP |
474 | return (void *)object + cache->kasan_info.free_meta_offset; |
475 | } | |
7ed2f9e6 | 476 | |
b3cbd9bf AR |
477 | void kasan_init_slab_obj(struct kmem_cache *cache, const void *object) |
478 | { | |
479 | struct kasan_alloc_meta *alloc_info; | |
480 | ||
481 | if (!(cache->flags & SLAB_KASAN)) | |
482 | return; | |
483 | ||
484 | alloc_info = get_alloc_info(cache, object); | |
485 | __memset(alloc_info, 0, sizeof(*alloc_info)); | |
486 | } | |
487 | ||
505f5dcb | 488 | void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags) |
0316bec2 | 489 | { |
505f5dcb | 490 | kasan_kmalloc(cache, object, cache->object_size, flags); |
0316bec2 AR |
491 | } |
492 | ||
1db0e0f9 DV |
493 | static bool __kasan_slab_free(struct kmem_cache *cache, void *object, |
494 | unsigned long ip, bool quarantine) | |
55834c59 | 495 | { |
b3cbd9bf | 496 | s8 shadow_byte; |
1db0e0f9 | 497 | unsigned long rounded_up_size; |
b3cbd9bf | 498 | |
b1d57289 DV |
499 | if (unlikely(nearest_obj(cache, virt_to_head_page(object), object) != |
500 | object)) { | |
501 | kasan_report_invalid_free(object, ip); | |
502 | return true; | |
503 | } | |
504 | ||
55834c59 | 505 | /* RCU slabs could be legally used after free within the RCU period */ |
5f0d5a3a | 506 | if (unlikely(cache->flags & SLAB_TYPESAFE_BY_RCU)) |
55834c59 AP |
507 | return false; |
508 | ||
b3cbd9bf AR |
509 | shadow_byte = READ_ONCE(*(s8 *)kasan_mem_to_shadow(object)); |
510 | if (shadow_byte < 0 || shadow_byte >= KASAN_SHADOW_SCALE_SIZE) { | |
ee3ce779 | 511 | kasan_report_invalid_free(object, ip); |
b3cbd9bf AR |
512 | return true; |
513 | } | |
80a9201a | 514 | |
1db0e0f9 DV |
515 | rounded_up_size = round_up(cache->object_size, KASAN_SHADOW_SCALE_SIZE); |
516 | kasan_poison_shadow(object, rounded_up_size, KASAN_KMALLOC_FREE); | |
55834c59 | 517 | |
1db0e0f9 | 518 | if (!quarantine || unlikely(!(cache->flags & SLAB_KASAN))) |
b3cbd9bf AR |
519 | return false; |
520 | ||
521 | set_track(&get_alloc_info(cache, object)->free_track, GFP_NOWAIT); | |
522 | quarantine_put(get_free_info(cache, object), cache); | |
523 | return true; | |
0316bec2 AR |
524 | } |
525 | ||
1db0e0f9 DV |
526 | bool kasan_slab_free(struct kmem_cache *cache, void *object, unsigned long ip) |
527 | { | |
528 | return __kasan_slab_free(cache, object, ip, true); | |
529 | } | |
530 | ||
505f5dcb AP |
531 | void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size, |
532 | gfp_t flags) | |
0316bec2 AR |
533 | { |
534 | unsigned long redzone_start; | |
535 | unsigned long redzone_end; | |
536 | ||
4b3ec5a3 | 537 | if (gfpflags_allow_blocking(flags)) |
55834c59 AP |
538 | quarantine_reduce(); |
539 | ||
0316bec2 AR |
540 | if (unlikely(object == NULL)) |
541 | return; | |
542 | ||
543 | redzone_start = round_up((unsigned long)(object + size), | |
544 | KASAN_SHADOW_SCALE_SIZE); | |
545 | redzone_end = round_up((unsigned long)object + cache->object_size, | |
546 | KASAN_SHADOW_SCALE_SIZE); | |
547 | ||
548 | kasan_unpoison_shadow(object, size); | |
549 | kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start, | |
550 | KASAN_KMALLOC_REDZONE); | |
7ed2f9e6 | 551 | |
b3cbd9bf AR |
552 | if (cache->flags & SLAB_KASAN) |
553 | set_track(&get_alloc_info(cache, object)->alloc_track, flags); | |
0316bec2 AR |
554 | } |
555 | EXPORT_SYMBOL(kasan_kmalloc); | |
556 | ||
505f5dcb | 557 | void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags) |
0316bec2 AR |
558 | { |
559 | struct page *page; | |
560 | unsigned long redzone_start; | |
561 | unsigned long redzone_end; | |
562 | ||
4b3ec5a3 | 563 | if (gfpflags_allow_blocking(flags)) |
55834c59 AP |
564 | quarantine_reduce(); |
565 | ||
0316bec2 AR |
566 | if (unlikely(ptr == NULL)) |
567 | return; | |
568 | ||
569 | page = virt_to_page(ptr); | |
570 | redzone_start = round_up((unsigned long)(ptr + size), | |
571 | KASAN_SHADOW_SCALE_SIZE); | |
572 | redzone_end = (unsigned long)ptr + (PAGE_SIZE << compound_order(page)); | |
573 | ||
574 | kasan_unpoison_shadow(ptr, size); | |
575 | kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start, | |
576 | KASAN_PAGE_REDZONE); | |
577 | } | |
578 | ||
505f5dcb | 579 | void kasan_krealloc(const void *object, size_t size, gfp_t flags) |
0316bec2 AR |
580 | { |
581 | struct page *page; | |
582 | ||
583 | if (unlikely(object == ZERO_SIZE_PTR)) | |
584 | return; | |
585 | ||
586 | page = virt_to_head_page(object); | |
587 | ||
588 | if (unlikely(!PageSlab(page))) | |
505f5dcb | 589 | kasan_kmalloc_large(object, size, flags); |
0316bec2 | 590 | else |
505f5dcb | 591 | kasan_kmalloc(page->slab_cache, object, size, flags); |
0316bec2 AR |
592 | } |
593 | ||
6860f634 | 594 | void kasan_poison_kfree(void *ptr, unsigned long ip) |
92393615 AR |
595 | { |
596 | struct page *page; | |
597 | ||
598 | page = virt_to_head_page(ptr); | |
599 | ||
6860f634 DV |
600 | if (unlikely(!PageSlab(page))) { |
601 | if (ptr != page_address(page)) { | |
602 | kasan_report_invalid_free(ptr, ip); | |
603 | return; | |
604 | } | |
92393615 AR |
605 | kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page), |
606 | KASAN_FREE_PAGE); | |
6860f634 | 607 | } else { |
1db0e0f9 | 608 | __kasan_slab_free(page->slab_cache, ptr, ip, false); |
6860f634 | 609 | } |
92393615 AR |
610 | } |
611 | ||
ee3ce779 | 612 | void kasan_kfree_large(void *ptr, unsigned long ip) |
0316bec2 | 613 | { |
47adccce | 614 | if (ptr != page_address(virt_to_head_page(ptr))) |
ee3ce779 | 615 | kasan_report_invalid_free(ptr, ip); |
47adccce | 616 | /* The object will be poisoned by page_alloc. */ |
0316bec2 AR |
617 | } |
618 | ||
bebf56a1 AR |
619 | int kasan_module_alloc(void *addr, size_t size) |
620 | { | |
621 | void *ret; | |
1e8e18f6 | 622 | size_t scaled_size; |
bebf56a1 AR |
623 | size_t shadow_size; |
624 | unsigned long shadow_start; | |
625 | ||
626 | shadow_start = (unsigned long)kasan_mem_to_shadow(addr); | |
1e8e18f6 ZL |
627 | scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT; |
628 | shadow_size = round_up(scaled_size, PAGE_SIZE); | |
bebf56a1 AR |
629 | |
630 | if (WARN_ON(!PAGE_ALIGNED(shadow_start))) | |
631 | return -EINVAL; | |
632 | ||
633 | ret = __vmalloc_node_range(shadow_size, 1, shadow_start, | |
634 | shadow_start + shadow_size, | |
19809c2d | 635 | GFP_KERNEL | __GFP_ZERO, |
bebf56a1 AR |
636 | PAGE_KERNEL, VM_NO_GUARD, NUMA_NO_NODE, |
637 | __builtin_return_address(0)); | |
a5af5aa8 AR |
638 | |
639 | if (ret) { | |
640 | find_vm_area(addr)->flags |= VM_KASAN; | |
45937254 | 641 | kmemleak_ignore(ret); |
a5af5aa8 AR |
642 | return 0; |
643 | } | |
644 | ||
645 | return -ENOMEM; | |
bebf56a1 AR |
646 | } |
647 | ||
a5af5aa8 | 648 | void kasan_free_shadow(const struct vm_struct *vm) |
bebf56a1 | 649 | { |
a5af5aa8 AR |
650 | if (vm->flags & VM_KASAN) |
651 | vfree(kasan_mem_to_shadow(vm->addr)); | |
bebf56a1 AR |
652 | } |
653 | ||
654 | static void register_global(struct kasan_global *global) | |
655 | { | |
656 | size_t aligned_size = round_up(global->size, KASAN_SHADOW_SCALE_SIZE); | |
657 | ||
658 | kasan_unpoison_shadow(global->beg, global->size); | |
659 | ||
660 | kasan_poison_shadow(global->beg + aligned_size, | |
661 | global->size_with_redzone - aligned_size, | |
662 | KASAN_GLOBAL_REDZONE); | |
663 | } | |
664 | ||
665 | void __asan_register_globals(struct kasan_global *globals, size_t size) | |
666 | { | |
667 | int i; | |
668 | ||
669 | for (i = 0; i < size; i++) | |
670 | register_global(&globals[i]); | |
671 | } | |
672 | EXPORT_SYMBOL(__asan_register_globals); | |
673 | ||
674 | void __asan_unregister_globals(struct kasan_global *globals, size_t size) | |
675 | { | |
676 | } | |
677 | EXPORT_SYMBOL(__asan_unregister_globals); | |
678 | ||
936bb4bb AR |
679 | #define DEFINE_ASAN_LOAD_STORE(size) \ |
680 | void __asan_load##size(unsigned long addr) \ | |
681 | { \ | |
682 | check_memory_region_inline(addr, size, false, _RET_IP_);\ | |
683 | } \ | |
684 | EXPORT_SYMBOL(__asan_load##size); \ | |
685 | __alias(__asan_load##size) \ | |
686 | void __asan_load##size##_noabort(unsigned long); \ | |
687 | EXPORT_SYMBOL(__asan_load##size##_noabort); \ | |
688 | void __asan_store##size(unsigned long addr) \ | |
689 | { \ | |
690 | check_memory_region_inline(addr, size, true, _RET_IP_); \ | |
691 | } \ | |
692 | EXPORT_SYMBOL(__asan_store##size); \ | |
693 | __alias(__asan_store##size) \ | |
694 | void __asan_store##size##_noabort(unsigned long); \ | |
0b24becc AR |
695 | EXPORT_SYMBOL(__asan_store##size##_noabort) |
696 | ||
697 | DEFINE_ASAN_LOAD_STORE(1); | |
698 | DEFINE_ASAN_LOAD_STORE(2); | |
699 | DEFINE_ASAN_LOAD_STORE(4); | |
700 | DEFINE_ASAN_LOAD_STORE(8); | |
701 | DEFINE_ASAN_LOAD_STORE(16); | |
702 | ||
703 | void __asan_loadN(unsigned long addr, size_t size) | |
704 | { | |
936bb4bb | 705 | check_memory_region(addr, size, false, _RET_IP_); |
0b24becc AR |
706 | } |
707 | EXPORT_SYMBOL(__asan_loadN); | |
708 | ||
709 | __alias(__asan_loadN) | |
710 | void __asan_loadN_noabort(unsigned long, size_t); | |
711 | EXPORT_SYMBOL(__asan_loadN_noabort); | |
712 | ||
713 | void __asan_storeN(unsigned long addr, size_t size) | |
714 | { | |
936bb4bb | 715 | check_memory_region(addr, size, true, _RET_IP_); |
0b24becc AR |
716 | } |
717 | EXPORT_SYMBOL(__asan_storeN); | |
718 | ||
719 | __alias(__asan_storeN) | |
720 | void __asan_storeN_noabort(unsigned long, size_t); | |
721 | EXPORT_SYMBOL(__asan_storeN_noabort); | |
722 | ||
723 | /* to shut up compiler complaints */ | |
724 | void __asan_handle_no_return(void) {} | |
725 | EXPORT_SYMBOL(__asan_handle_no_return); | |
786a8959 | 726 | |
828347f8 DV |
727 | /* Emitted by compiler to poison large objects when they go out of scope. */ |
728 | void __asan_poison_stack_memory(const void *addr, size_t size) | |
729 | { | |
730 | /* | |
731 | * Addr is KASAN_SHADOW_SCALE_SIZE-aligned and the object is surrounded | |
732 | * by redzones, so we simply round up size to simplify logic. | |
733 | */ | |
734 | kasan_poison_shadow(addr, round_up(size, KASAN_SHADOW_SCALE_SIZE), | |
735 | KASAN_USE_AFTER_SCOPE); | |
736 | } | |
737 | EXPORT_SYMBOL(__asan_poison_stack_memory); | |
738 | ||
739 | /* Emitted by compiler to unpoison large objects when they go into scope. */ | |
740 | void __asan_unpoison_stack_memory(const void *addr, size_t size) | |
741 | { | |
742 | kasan_unpoison_shadow(addr, size); | |
743 | } | |
744 | EXPORT_SYMBOL(__asan_unpoison_stack_memory); | |
745 | ||
342061ee PL |
746 | /* Emitted by compiler to poison alloca()ed objects. */ |
747 | void __asan_alloca_poison(unsigned long addr, size_t size) | |
748 | { | |
749 | size_t rounded_up_size = round_up(size, KASAN_SHADOW_SCALE_SIZE); | |
750 | size_t padding_size = round_up(size, KASAN_ALLOCA_REDZONE_SIZE) - | |
751 | rounded_up_size; | |
752 | size_t rounded_down_size = round_down(size, KASAN_SHADOW_SCALE_SIZE); | |
753 | ||
754 | const void *left_redzone = (const void *)(addr - | |
755 | KASAN_ALLOCA_REDZONE_SIZE); | |
756 | const void *right_redzone = (const void *)(addr + rounded_up_size); | |
757 | ||
758 | WARN_ON(!IS_ALIGNED(addr, KASAN_ALLOCA_REDZONE_SIZE)); | |
759 | ||
760 | kasan_unpoison_shadow((const void *)(addr + rounded_down_size), | |
761 | size - rounded_down_size); | |
762 | kasan_poison_shadow(left_redzone, KASAN_ALLOCA_REDZONE_SIZE, | |
763 | KASAN_ALLOCA_LEFT); | |
764 | kasan_poison_shadow(right_redzone, | |
765 | padding_size + KASAN_ALLOCA_REDZONE_SIZE, | |
766 | KASAN_ALLOCA_RIGHT); | |
767 | } | |
768 | EXPORT_SYMBOL(__asan_alloca_poison); | |
769 | ||
770 | /* Emitted by compiler to unpoison alloca()ed areas when the stack unwinds. */ | |
771 | void __asan_allocas_unpoison(const void *stack_top, const void *stack_bottom) | |
772 | { | |
773 | if (unlikely(!stack_top || stack_top > stack_bottom)) | |
774 | return; | |
775 | ||
776 | kasan_unpoison_shadow(stack_top, stack_bottom - stack_top); | |
777 | } | |
778 | EXPORT_SYMBOL(__asan_allocas_unpoison); | |
779 | ||
d321599c AP |
780 | /* Emitted by the compiler to [un]poison local variables. */ |
781 | #define DEFINE_ASAN_SET_SHADOW(byte) \ | |
782 | void __asan_set_shadow_##byte(const void *addr, size_t size) \ | |
783 | { \ | |
784 | __memset((void *)addr, 0x##byte, size); \ | |
785 | } \ | |
786 | EXPORT_SYMBOL(__asan_set_shadow_##byte) | |
787 | ||
788 | DEFINE_ASAN_SET_SHADOW(00); | |
789 | DEFINE_ASAN_SET_SHADOW(f1); | |
790 | DEFINE_ASAN_SET_SHADOW(f2); | |
791 | DEFINE_ASAN_SET_SHADOW(f3); | |
792 | DEFINE_ASAN_SET_SHADOW(f5); | |
793 | DEFINE_ASAN_SET_SHADOW(f8); | |
794 | ||
786a8959 | 795 | #ifdef CONFIG_MEMORY_HOTPLUG |
0f901dcb AR |
796 | static bool shadow_mapped(unsigned long addr) |
797 | { | |
798 | pgd_t *pgd = pgd_offset_k(addr); | |
799 | p4d_t *p4d; | |
800 | pud_t *pud; | |
801 | pmd_t *pmd; | |
802 | pte_t *pte; | |
803 | ||
804 | if (pgd_none(*pgd)) | |
805 | return false; | |
806 | p4d = p4d_offset(pgd, addr); | |
807 | if (p4d_none(*p4d)) | |
808 | return false; | |
809 | pud = pud_offset(p4d, addr); | |
810 | if (pud_none(*pud)) | |
811 | return false; | |
812 | ||
813 | /* | |
814 | * We can't use pud_large() or pud_huge(), the first one is | |
815 | * arch-specific, the last one depends on HUGETLB_PAGE. So let's abuse | |
816 | * pud_bad(), if pud is bad then it's bad because it's huge. | |
817 | */ | |
818 | if (pud_bad(*pud)) | |
819 | return true; | |
820 | pmd = pmd_offset(pud, addr); | |
821 | if (pmd_none(*pmd)) | |
822 | return false; | |
823 | ||
824 | if (pmd_bad(*pmd)) | |
825 | return true; | |
826 | pte = pte_offset_kernel(pmd, addr); | |
827 | return !pte_none(*pte); | |
828 | } | |
829 | ||
fa69b598 | 830 | static int __meminit kasan_mem_notifier(struct notifier_block *nb, |
786a8959 AR |
831 | unsigned long action, void *data) |
832 | { | |
fa69b598 AR |
833 | struct memory_notify *mem_data = data; |
834 | unsigned long nr_shadow_pages, start_kaddr, shadow_start; | |
835 | unsigned long shadow_end, shadow_size; | |
836 | ||
837 | nr_shadow_pages = mem_data->nr_pages >> KASAN_SHADOW_SCALE_SHIFT; | |
838 | start_kaddr = (unsigned long)pfn_to_kaddr(mem_data->start_pfn); | |
839 | shadow_start = (unsigned long)kasan_mem_to_shadow((void *)start_kaddr); | |
840 | shadow_size = nr_shadow_pages << PAGE_SHIFT; | |
841 | shadow_end = shadow_start + shadow_size; | |
842 | ||
843 | if (WARN_ON(mem_data->nr_pages % KASAN_SHADOW_SCALE_SIZE) || | |
844 | WARN_ON(start_kaddr % (KASAN_SHADOW_SCALE_SIZE << PAGE_SHIFT))) | |
845 | return NOTIFY_BAD; | |
846 | ||
847 | switch (action) { | |
848 | case MEM_GOING_ONLINE: { | |
849 | void *ret; | |
850 | ||
0f901dcb AR |
851 | /* |
852 | * If shadow is mapped already than it must have been mapped | |
853 | * during the boot. This could happen if we onlining previously | |
854 | * offlined memory. | |
855 | */ | |
856 | if (shadow_mapped(shadow_start)) | |
857 | return NOTIFY_OK; | |
858 | ||
fa69b598 AR |
859 | ret = __vmalloc_node_range(shadow_size, PAGE_SIZE, shadow_start, |
860 | shadow_end, GFP_KERNEL, | |
861 | PAGE_KERNEL, VM_NO_GUARD, | |
862 | pfn_to_nid(mem_data->start_pfn), | |
863 | __builtin_return_address(0)); | |
864 | if (!ret) | |
865 | return NOTIFY_BAD; | |
866 | ||
867 | kmemleak_ignore(ret); | |
868 | return NOTIFY_OK; | |
869 | } | |
ed1596f9 | 870 | case MEM_CANCEL_ONLINE: |
0f901dcb AR |
871 | case MEM_OFFLINE: { |
872 | struct vm_struct *vm; | |
873 | ||
874 | /* | |
875 | * shadow_start was either mapped during boot by kasan_init() | |
876 | * or during memory online by __vmalloc_node_range(). | |
877 | * In the latter case we can use vfree() to free shadow. | |
878 | * Non-NULL result of the find_vm_area() will tell us if | |
879 | * that was the second case. | |
880 | * | |
881 | * Currently it's not possible to free shadow mapped | |
882 | * during boot by kasan_init(). It's because the code | |
883 | * to do that hasn't been written yet. So we'll just | |
884 | * leak the memory. | |
885 | */ | |
886 | vm = find_vm_area((void *)shadow_start); | |
887 | if (vm) | |
888 | vfree((void *)shadow_start); | |
889 | } | |
fa69b598 AR |
890 | } |
891 | ||
892 | return NOTIFY_OK; | |
786a8959 AR |
893 | } |
894 | ||
895 | static int __init kasan_memhotplug_init(void) | |
896 | { | |
786a8959 AR |
897 | hotplug_memory_notifier(kasan_mem_notifier, 0); |
898 | ||
899 | return 0; | |
900 | } | |
901 | ||
3f195972 | 902 | core_initcall(kasan_memhotplug_init); |
786a8959 | 903 | #endif |