2 * This file contains error reporting code.
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <a.ryabinin@samsung.com>
7 * Some of code borrowed from https://github.com/xairy/linux by
8 * Andrey Konovalov <adech.fo@gmail.com>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
18 #include <linux/printk.h>
19 #include <linux/sched.h>
20 #include <linux/slab.h>
21 #include <linux/stacktrace.h>
22 #include <linux/string.h>
23 #include <linux/types.h>
24 #include <linux/kasan.h>
28 /* Shadow layout customization. */
29 #define SHADOW_BYTES_PER_BLOCK 1
30 #define SHADOW_BLOCKS_PER_ROW 16
31 #define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK)
32 #define SHADOW_ROWS_AROUND_ADDR 2
34 static const void *find_first_bad_addr(const void *addr
, size_t size
)
36 u8 shadow_val
= *(u8
*)kasan_mem_to_shadow(addr
);
37 const void *first_bad_addr
= addr
;
39 while (!shadow_val
&& first_bad_addr
< addr
+ size
) {
40 first_bad_addr
+= KASAN_SHADOW_SCALE_SIZE
;
41 shadow_val
= *(u8
*)kasan_mem_to_shadow(first_bad_addr
);
43 return first_bad_addr
;
46 static void print_error_description(struct kasan_access_info
*info
)
48 const char *bug_type
= "unknown crash";
51 info
->first_bad_addr
= find_first_bad_addr(info
->access_addr
,
54 shadow_val
= *(u8
*)kasan_mem_to_shadow(info
->first_bad_addr
);
57 case 0 ... KASAN_SHADOW_SCALE_SIZE
- 1:
58 bug_type
= "out of bounds access";
62 pr_err("BUG: KASan: %s in %pS at addr %p\n",
63 bug_type
, (void *)info
->ip
,
65 pr_err("%s of size %zu by task %s/%d\n",
66 info
->is_write
? "Write" : "Read",
67 info
->access_size
, current
->comm
, task_pid_nr(current
));
70 static void print_address_description(struct kasan_access_info
*info
)
75 static bool row_is_guilty(const void *row
, const void *guilty
)
77 return (row
<= guilty
) && (guilty
< row
+ SHADOW_BYTES_PER_ROW
);
80 static int shadow_pointer_offset(const void *row
, const void *shadow
)
82 /* The length of ">ff00ff00ff00ff00: " is
83 * 3 + (BITS_PER_LONG/8)*2 chars.
85 return 3 + (BITS_PER_LONG
/8)*2 + (shadow
- row
)*2 +
86 (shadow
- row
) / SHADOW_BYTES_PER_BLOCK
+ 1;
89 static void print_shadow_for_address(const void *addr
)
92 const void *shadow
= kasan_mem_to_shadow(addr
);
93 const void *shadow_row
;
95 shadow_row
= (void *)round_down((unsigned long)shadow
,
97 - SHADOW_ROWS_AROUND_ADDR
* SHADOW_BYTES_PER_ROW
;
99 pr_err("Memory state around the buggy address:\n");
101 for (i
= -SHADOW_ROWS_AROUND_ADDR
; i
<= SHADOW_ROWS_AROUND_ADDR
; i
++) {
102 const void *kaddr
= kasan_shadow_to_mem(shadow_row
);
103 char buffer
[4 + (BITS_PER_LONG
/8)*2];
105 snprintf(buffer
, sizeof(buffer
),
106 (i
== 0) ? ">%p: " : " %p: ", kaddr
);
108 kasan_disable_current();
109 print_hex_dump(KERN_ERR
, buffer
,
110 DUMP_PREFIX_NONE
, SHADOW_BYTES_PER_ROW
, 1,
111 shadow_row
, SHADOW_BYTES_PER_ROW
, 0);
112 kasan_enable_current();
114 if (row_is_guilty(shadow_row
, shadow
))
116 shadow_pointer_offset(shadow_row
, shadow
),
119 shadow_row
+= SHADOW_BYTES_PER_ROW
;
123 static DEFINE_SPINLOCK(report_lock
);
125 void kasan_report_error(struct kasan_access_info
*info
)
129 spin_lock_irqsave(&report_lock
, flags
);
130 pr_err("================================="
131 "=================================\n");
132 print_error_description(info
);
133 print_address_description(info
);
134 print_shadow_for_address(info
->first_bad_addr
);
135 pr_err("================================="
136 "=================================\n");
137 spin_unlock_irqrestore(&report_lock
, flags
);
140 void kasan_report_user_access(struct kasan_access_info
*info
)
144 spin_lock_irqsave(&report_lock
, flags
);
145 pr_err("================================="
146 "=================================\n");
147 pr_err("BUG: KASan: user-memory-access on address %p\n",
149 pr_err("%s of size %zu by task %s/%d\n",
150 info
->is_write
? "Write" : "Read",
151 info
->access_size
, current
->comm
, task_pid_nr(current
));
153 pr_err("================================="
154 "=================================\n");
155 spin_unlock_irqrestore(&report_lock
, flags
);
158 void kasan_report(unsigned long addr
, size_t size
,
159 bool is_write
, unsigned long ip
)
161 struct kasan_access_info info
;
163 if (likely(!kasan_enabled()))
166 info
.access_addr
= (void *)addr
;
167 info
.access_size
= size
;
168 info
.is_write
= is_write
;
170 kasan_report_error(&info
);
174 #define DEFINE_ASAN_REPORT_LOAD(size) \
175 void __asan_report_load##size##_noabort(unsigned long addr) \
177 kasan_report(addr, size, false, _RET_IP_); \
179 EXPORT_SYMBOL(__asan_report_load##size##_noabort)
181 #define DEFINE_ASAN_REPORT_STORE(size) \
182 void __asan_report_store##size##_noabort(unsigned long addr) \
184 kasan_report(addr, size, true, _RET_IP_); \
186 EXPORT_SYMBOL(__asan_report_store##size##_noabort)
188 DEFINE_ASAN_REPORT_LOAD(1);
189 DEFINE_ASAN_REPORT_LOAD(2);
190 DEFINE_ASAN_REPORT_LOAD(4);
191 DEFINE_ASAN_REPORT_LOAD(8);
192 DEFINE_ASAN_REPORT_LOAD(16);
193 DEFINE_ASAN_REPORT_STORE(1);
194 DEFINE_ASAN_REPORT_STORE(2);
195 DEFINE_ASAN_REPORT_STORE(4);
196 DEFINE_ASAN_REPORT_STORE(8);
197 DEFINE_ASAN_REPORT_STORE(16);
199 void __asan_report_load_n_noabort(unsigned long addr
, size_t size
)
201 kasan_report(addr
, size
, false, _RET_IP_
);
203 EXPORT_SYMBOL(__asan_report_load_n_noabort
);
205 void __asan_report_store_n_noabort(unsigned long addr
, size_t size
)
207 kasan_report(addr
, size
, true, _RET_IP_
);
209 EXPORT_SYMBOL(__asan_report_store_n_noabort
);