2 * This file contains error reporting code.
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
7 * Some of code borrowed from https://github.com/xairy/linux by
8 * Andrey Konovalov <adech.fo@gmail.com>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
18 #include <linux/printk.h>
19 #include <linux/sched.h>
20 #include <linux/slab.h>
21 #include <linux/stacktrace.h>
22 #include <linux/string.h>
23 #include <linux/types.h>
24 #include <linux/kasan.h>
25 #include <linux/module.h>
27 #include <asm/sections.h>
32 /* Shadow layout customization. */
33 #define SHADOW_BYTES_PER_BLOCK 1
34 #define SHADOW_BLOCKS_PER_ROW 16
35 #define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK)
36 #define SHADOW_ROWS_AROUND_ADDR 2
38 static const void *find_first_bad_addr(const void *addr
, size_t size
)
40 u8 shadow_val
= *(u8
*)kasan_mem_to_shadow(addr
);
41 const void *first_bad_addr
= addr
;
43 while (!shadow_val
&& first_bad_addr
< addr
+ size
) {
44 first_bad_addr
+= KASAN_SHADOW_SCALE_SIZE
;
45 shadow_val
= *(u8
*)kasan_mem_to_shadow(first_bad_addr
);
47 return first_bad_addr
;
50 static void print_error_description(struct kasan_access_info
*info
)
52 const char *bug_type
= "unknown-crash";
55 info
->first_bad_addr
= find_first_bad_addr(info
->access_addr
,
58 shadow_val
= *(u8
*)kasan_mem_to_shadow(info
->first_bad_addr
);
61 case 0 ... KASAN_SHADOW_SCALE_SIZE
- 1:
62 bug_type
= "out-of-bounds";
64 case KASAN_PAGE_REDZONE
:
65 case KASAN_KMALLOC_REDZONE
:
66 bug_type
= "slab-out-of-bounds";
68 case KASAN_GLOBAL_REDZONE
:
69 bug_type
= "global-out-of-bounds";
71 case KASAN_STACK_LEFT
:
73 case KASAN_STACK_RIGHT
:
74 case KASAN_STACK_PARTIAL
:
75 bug_type
= "stack-out-of-bounds";
78 case KASAN_KMALLOC_FREE
:
79 bug_type
= "use-after-free";
83 pr_err("BUG: KASan: %s in %pS at addr %p\n",
84 bug_type
, (void *)info
->ip
,
86 pr_err("%s of size %zu by task %s/%d\n",
87 info
->is_write
? "Write" : "Read",
88 info
->access_size
, current
->comm
, task_pid_nr(current
));
91 static inline bool kernel_or_module_addr(const void *addr
)
93 if (addr
>= (void *)_stext
&& addr
< (void *)_end
)
95 if (is_module_address((unsigned long)addr
))
100 static inline bool init_task_stack_addr(const void *addr
)
102 return addr
>= (void *)&init_thread_union
.stack
&&
103 (addr
<= (void *)&init_thread_union
.stack
+
104 sizeof(init_thread_union
.stack
));
107 static void print_address_description(struct kasan_access_info
*info
)
109 const void *addr
= info
->access_addr
;
111 if ((addr
>= (void *)PAGE_OFFSET
) &&
112 (addr
< high_memory
)) {
113 struct page
*page
= virt_to_head_page(addr
);
115 if (PageSlab(page
)) {
117 struct kmem_cache
*cache
= page
->slab_cache
;
120 object
= virt_to_obj(cache
, page_address(page
), addr
);
121 last_object
= page_address(page
) +
122 page
->objects
* cache
->size
;
124 if (unlikely(object
> last_object
))
125 object
= last_object
; /* we hit into padding */
127 object_err(cache
, page
, object
,
128 "kasan: bad access detected");
131 dump_page(page
, "kasan: bad access detected");
134 if (kernel_or_module_addr(addr
)) {
135 if (!init_task_stack_addr(addr
))
136 pr_err("Address belongs to variable %pS\n", addr
);
142 static bool row_is_guilty(const void *row
, const void *guilty
)
144 return (row
<= guilty
) && (guilty
< row
+ SHADOW_BYTES_PER_ROW
);
147 static int shadow_pointer_offset(const void *row
, const void *shadow
)
149 /* The length of ">ff00ff00ff00ff00: " is
150 * 3 + (BITS_PER_LONG/8)*2 chars.
152 return 3 + (BITS_PER_LONG
/8)*2 + (shadow
- row
)*2 +
153 (shadow
- row
) / SHADOW_BYTES_PER_BLOCK
+ 1;
156 static void print_shadow_for_address(const void *addr
)
159 const void *shadow
= kasan_mem_to_shadow(addr
);
160 const void *shadow_row
;
162 shadow_row
= (void *)round_down((unsigned long)shadow
,
163 SHADOW_BYTES_PER_ROW
)
164 - SHADOW_ROWS_AROUND_ADDR
* SHADOW_BYTES_PER_ROW
;
166 pr_err("Memory state around the buggy address:\n");
168 for (i
= -SHADOW_ROWS_AROUND_ADDR
; i
<= SHADOW_ROWS_AROUND_ADDR
; i
++) {
169 const void *kaddr
= kasan_shadow_to_mem(shadow_row
);
170 char buffer
[4 + (BITS_PER_LONG
/8)*2];
171 char shadow_buf
[SHADOW_BYTES_PER_ROW
];
173 snprintf(buffer
, sizeof(buffer
),
174 (i
== 0) ? ">%p: " : " %p: ", kaddr
);
176 * We should not pass a shadow pointer to generic
177 * function, because generic functions may try to
178 * access kasan mapping for the passed address.
180 memcpy(shadow_buf
, shadow_row
, SHADOW_BYTES_PER_ROW
);
181 print_hex_dump(KERN_ERR
, buffer
,
182 DUMP_PREFIX_NONE
, SHADOW_BYTES_PER_ROW
, 1,
183 shadow_buf
, SHADOW_BYTES_PER_ROW
, 0);
185 if (row_is_guilty(shadow_row
, shadow
))
187 shadow_pointer_offset(shadow_row
, shadow
),
190 shadow_row
+= SHADOW_BYTES_PER_ROW
;
194 static DEFINE_SPINLOCK(report_lock
);
196 static void kasan_report_error(struct kasan_access_info
*info
)
199 const char *bug_type
;
202 * Make sure we don't end up in loop.
204 kasan_disable_current();
205 spin_lock_irqsave(&report_lock
, flags
);
206 pr_err("================================="
207 "=================================\n");
208 if (info
->access_addr
<
209 kasan_shadow_to_mem((void *)KASAN_SHADOW_START
)) {
210 if ((unsigned long)info
->access_addr
< PAGE_SIZE
)
211 bug_type
= "null-ptr-deref";
212 else if ((unsigned long)info
->access_addr
< TASK_SIZE
)
213 bug_type
= "user-memory-access";
215 bug_type
= "wild-memory-access";
216 pr_err("BUG: KASan: %s on address %p\n",
217 bug_type
, info
->access_addr
);
218 pr_err("%s of size %zu by task %s/%d\n",
219 info
->is_write
? "Write" : "Read",
220 info
->access_size
, current
->comm
,
221 task_pid_nr(current
));
224 print_error_description(info
);
225 print_address_description(info
);
226 print_shadow_for_address(info
->first_bad_addr
);
228 pr_err("================================="
229 "=================================\n");
230 spin_unlock_irqrestore(&report_lock
, flags
);
231 kasan_enable_current();
234 void kasan_report(unsigned long addr
, size_t size
,
235 bool is_write
, unsigned long ip
)
237 struct kasan_access_info info
;
239 if (likely(!kasan_report_enabled()))
242 info
.access_addr
= (void *)addr
;
243 info
.access_size
= size
;
244 info
.is_write
= is_write
;
247 kasan_report_error(&info
);
251 #define DEFINE_ASAN_REPORT_LOAD(size) \
252 void __asan_report_load##size##_noabort(unsigned long addr) \
254 kasan_report(addr, size, false, _RET_IP_); \
256 EXPORT_SYMBOL(__asan_report_load##size##_noabort)
258 #define DEFINE_ASAN_REPORT_STORE(size) \
259 void __asan_report_store##size##_noabort(unsigned long addr) \
261 kasan_report(addr, size, true, _RET_IP_); \
263 EXPORT_SYMBOL(__asan_report_store##size##_noabort)
265 DEFINE_ASAN_REPORT_LOAD(1);
266 DEFINE_ASAN_REPORT_LOAD(2);
267 DEFINE_ASAN_REPORT_LOAD(4);
268 DEFINE_ASAN_REPORT_LOAD(8);
269 DEFINE_ASAN_REPORT_LOAD(16);
270 DEFINE_ASAN_REPORT_STORE(1);
271 DEFINE_ASAN_REPORT_STORE(2);
272 DEFINE_ASAN_REPORT_STORE(4);
273 DEFINE_ASAN_REPORT_STORE(8);
274 DEFINE_ASAN_REPORT_STORE(16);
276 void __asan_report_load_n_noabort(unsigned long addr
, size_t size
)
278 kasan_report(addr
, size
, false, _RET_IP_
);
280 EXPORT_SYMBOL(__asan_report_load_n_noabort
);
282 void __asan_report_store_n_noabort(unsigned long addr
, size_t size
)
284 kasan_report(addr
, size
, true, _RET_IP_
);
286 EXPORT_SYMBOL(__asan_report_store_n_noabort
);