report.c 12.7 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0
2
/*
3
 * This file contains common KASAN error reporting code.
4
5
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
6
 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
7
 *
8
 * Some code borrowed from https://github.com/xairy/kasan-prototype by
9
 *        Andrey Konovalov <andreyknvl@gmail.com>
10
11
 */

12
#include <linux/bitops.h>
13
#include <linux/ftrace.h>
14
#include <linux/init.h>
15
16
17
18
19
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/printk.h>
#include <linux/sched.h>
#include <linux/slab.h>
20
#include <linux/stackdepot.h>
21
22
23
24
#include <linux/stacktrace.h>
#include <linux/string.h>
#include <linux/types.h>
#include <linux/kasan.h>
25
#include <linux/module.h>
26
#include <linux/sched/task_stack.h>
27
#include <linux/uaccess.h>
28
#include <trace/events/error_report.h>
29

30
31
#include <asm/sections.h>

Patricia Alfonso's avatar
Patricia Alfonso committed
32
33
#include <kunit/test.h>

34
#include "kasan.h"
35
#include "../slab.h"
36

37
static unsigned long kasan_flags;
38

39
40
#define KASAN_BIT_REPORTED	0
#define KASAN_BIT_MULTI_SHOT	1
41

42
bool kasan_save_enable_multi_shot(void)
43
{
44
	return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
45
}
46
EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
47

48
void kasan_restore_multi_shot(bool enabled)
49
{
50
51
	if (!enabled)
		clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
52
}
53
EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
54

55
static int __init kasan_set_multi_shot(char *str)
Andrey Konovalov's avatar
Andrey Konovalov committed
56
{
57
58
	set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
	return 1;
Andrey Konovalov's avatar
Andrey Konovalov committed
59
}
60
__setup("kasan_multi_shot", kasan_set_multi_shot);
Andrey Konovalov's avatar
Andrey Konovalov committed
61

62
static void print_error_description(struct kasan_access_info *info)
63
{
Andrey Konovalov's avatar
Andrey Konovalov committed
64
	pr_err("BUG: KASAN: %s in %pS\n",
65
		kasan_get_bug_type(info), (void *)info->ip);
66
67
68
69
70
71
72
73
	if (info->access_size)
		pr_err("%s of size %zu at addr %px by task %s/%d\n",
			info->is_write ? "Write" : "Read", info->access_size,
			info->access_addr, current->comm, task_pid_nr(current));
	else
		pr_err("%s at addr %px by task %s/%d\n",
			info->is_write ? "Write" : "Read",
			info->access_addr, current->comm, task_pid_nr(current));
74
75
}

76
77
static DEFINE_SPINLOCK(report_lock);

78
static void start_report(unsigned long *flags)
79
80
81
82
83
84
85
86
87
{
	/*
	 * Make sure we don't end up in loop.
	 */
	kasan_disable_current();
	spin_lock_irqsave(&report_lock, *flags);
	pr_err("==================================================================\n");
}

88
static void end_report(unsigned long *flags, unsigned long addr)
89
{
90
91
	if (!kasan_async_mode_enabled())
		trace_error_report_end(ERROR_DETECTOR_KASAN, addr);
92
93
94
	pr_err("==================================================================\n");
	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
	spin_unlock_irqrestore(&report_lock, *flags);
95
	if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) {
96
97
98
99
100
101
102
		/*
		 * This thread may hit another WARN() in the panic path.
		 * Resetting this prevents additional WARN() from panicking the
		 * system on this thread.  Other threads are blocked by the
		 * panic_mutex in panic().
		 */
		panic_on_warn = 0;
Dmitry Vyukov's avatar
Dmitry Vyukov committed
103
		panic("panic_on_warn set ...\n");
104
	}
105
106
107
108
#ifdef CONFIG_KASAN_HW_TAGS
	if (kasan_flag_panic)
		panic("kasan.fault=panic set ...\n");
#endif
109
110
111
	kasan_enable_current();
}

112
113
114
115
116
117
118
119
120
static void print_stack(depot_stack_handle_t stack)
{
	unsigned long *entries;
	unsigned int nr_entries;

	nr_entries = stack_depot_fetch(stack, &entries);
	stack_trace_print(entries, nr_entries, 0);
}

121
static void print_track(struct kasan_track *track, const char *prefix)
Alexander Potapenko's avatar
Alexander Potapenko committed
122
{
123
	pr_err("%s by task %u:\n", prefix, track->pid);
124
	if (track->stack) {
125
		print_stack(track->stack);
126
127
128
	} else {
		pr_err("(stack is not available)\n");
	}
Alexander Potapenko's avatar
Alexander Potapenko committed
129
130
}

131
struct page *kasan_addr_to_page(const void *addr)
132
133
134
135
136
137
138
{
	if ((addr >= (void *)PAGE_OFFSET) &&
			(addr < high_memory))
		return virt_to_head_page(addr);
	return NULL;
}

139
140
static void describe_object_addr(struct kmem_cache *cache, void *object,
				const void *addr)
Alexander Potapenko's avatar
Alexander Potapenko committed
141
{
142
143
144
145
	unsigned long access_addr = (unsigned long)addr;
	unsigned long object_addr = (unsigned long)object;
	const char *rel_type;
	int rel_bytes;
Alexander Potapenko's avatar
Alexander Potapenko committed
146

147
	pr_err("The buggy address belongs to the object at %px\n"
148
149
	       " which belongs to the cache %s of size %d\n",
		object, cache->name, cache->object_size);
150

151
	if (!addr)
Alexander Potapenko's avatar
Alexander Potapenko committed
152
		return;
153

154
155
156
157
158
159
160
161
162
163
164
165
	if (access_addr < object_addr) {
		rel_type = "to the left";
		rel_bytes = object_addr - access_addr;
	} else if (access_addr >= object_addr + cache->object_size) {
		rel_type = "to the right";
		rel_bytes = access_addr - (object_addr + cache->object_size);
	} else {
		rel_type = "inside";
		rel_bytes = access_addr - object_addr;
	}

	pr_err("The buggy address is located %d bytes %s of\n"
166
	       " %d-byte region [%px, %px)\n",
167
168
169
170
		rel_bytes, rel_type, cache->object_size, (void *)object_addr,
		(void *)(object_addr + cache->object_size));
}

171
172
static void describe_object_stacks(struct kmem_cache *cache, void *object,
					const void *addr, u8 tag)
173
{
174
175
	struct kasan_alloc_meta *alloc_meta;
	struct kasan_track *free_track;
176

177
178
	alloc_meta = kasan_get_alloc_meta(cache, object);
	if (alloc_meta) {
179
		print_track(&alloc_meta->alloc_track, "Allocated");
180
		pr_err("\n");
181
182
183
184
185
186
187
	}

	free_track = kasan_get_free_track(cache, object, tag);
	if (free_track) {
		print_track(free_track, "Freed");
		pr_err("\n");
	}
188
189

#ifdef CONFIG_KASAN_GENERIC
190
191
192
193
194
195
	if (!alloc_meta)
		return;
	if (alloc_meta->aux_stack[0]) {
		pr_err("Last potentially related work creation:\n");
		print_stack(alloc_meta->aux_stack[0]);
		pr_err("\n");
196
	}
197
198
199
200
201
202
	if (alloc_meta->aux_stack[1]) {
		pr_err("Second to last potentially related work creation:\n");
		print_stack(alloc_meta->aux_stack[1]);
		pr_err("\n");
	}
#endif
203
}
204

205
206
207
208
209
static void describe_object(struct kmem_cache *cache, void *object,
				const void *addr, u8 tag)
{
	if (kasan_stack_collection_enabled())
		describe_object_stacks(cache, object, addr, tag);
210
	describe_object_addr(cache, object, addr);
Alexander Potapenko's avatar
Alexander Potapenko committed
211
212
}

213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
static inline bool kernel_or_module_addr(const void *addr)
{
	if (addr >= (void *)_stext && addr < (void *)_end)
		return true;
	if (is_module_address((unsigned long)addr))
		return true;
	return false;
}

static inline bool init_task_stack_addr(const void *addr)
{
	return addr >= (void *)&init_thread_union.stack &&
		(addr <= (void *)&init_thread_union.stack +
			sizeof(init_thread_union.stack));
}

229
static void print_address_description(void *addr, u8 tag)
230
{
231
	struct page *page = kasan_addr_to_page(addr);
232

233
	dump_stack();
234
	pr_err("\n");
235
236
237

	if (page && PageSlab(page)) {
		struct kmem_cache *cache = page->slab_cache;
238
		void *object = nearest_obj(cache, page,	addr);
239

240
		describe_object(cache, object, addr, tag);
241
242
	}

243
244
245
246
247
248
249
250
	if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) {
		pr_err("The buggy address belongs to the variable:\n");
		pr_err(" %pS\n", addr);
	}

	if (page) {
		pr_err("The buggy address belongs to the page:\n");
		dump_page(page, "kasan: bad access detected");
251
	}
252

253
	kasan_print_address_stack_frame(addr);
254
255
}

256
static bool meta_row_is_guilty(const void *row, const void *addr)
257
{
258
	return (row <= addr) && (addr < row + META_MEM_BYTES_PER_ROW);
259
260
}

261
static int meta_pointer_offset(const void *row, const void *addr)
262
{
263
264
265
266
267
268
269
270
271
	/*
	 * Memory state around the buggy address:
	 *  ff00ff00ff00ff00: 00 00 00 05 fe fe fe fe fe fe fe fe fe fe fe fe
	 *  ...
	 *
	 * The length of ">ff00ff00ff00ff00: " is
	 *    3 + (BITS_PER_LONG / 8) * 2 chars.
	 * The length of each granule metadata is 2 bytes
	 *    plus 1 byte for space.
272
	 */
273
274
	return 3 + (BITS_PER_LONG / 8) * 2 +
		(addr - row) / KASAN_GRANULE_SIZE * 3 + 1;
275
276
}

277
static void print_memory_metadata(const void *addr)
278
279
{
	int i;
280
	void *row;
281

282
283
	row = (void *)round_down((unsigned long)addr, META_MEM_BYTES_PER_ROW)
			- META_ROWS_AROUND_ADDR * META_MEM_BYTES_PER_ROW;
284
285
286

	pr_err("Memory state around the buggy address:\n");

287
	for (i = -META_ROWS_AROUND_ADDR; i <= META_ROWS_AROUND_ADDR; i++) {
288
289
		char buffer[4 + (BITS_PER_LONG / 8) * 2];
		char metadata[META_BYTES_PER_ROW];
290
291

		snprintf(buffer, sizeof(buffer),
292
293
				(i == 0) ? ">%px: " : " %px: ", row);

294
295
296
297
298
		/*
		 * We should not pass a shadow pointer to generic
		 * function, because generic functions may try to
		 * access kasan mapping for the passed address.
		 */
299
		kasan_metadata_fetch_row(&metadata[0], row);
300

301
		print_hex_dump(KERN_ERR, buffer,
302
			DUMP_PREFIX_NONE, META_BYTES_PER_ROW, 1,
303
			metadata, META_BYTES_PER_ROW, 0);
304

305
306
		if (meta_row_is_guilty(row, addr))
			pr_err("%*c\n", meta_pointer_offset(row, addr), '^');
307

308
		row += META_MEM_BYTES_PER_ROW;
309
310
311
	}
}

312
static bool report_enabled(void)
313
{
314
#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
315
316
	if (current->kasan_depth)
		return false;
317
#endif
318
319
320
321
322
	if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
		return true;
	return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
}

Patricia Alfonso's avatar
Patricia Alfonso committed
323
324
325
326
327
328
329
330
331
332
333
334
335
336
#if IS_ENABLED(CONFIG_KUNIT)
static void kasan_update_kunit_status(struct kunit *cur_test)
{
	struct kunit_resource *resource;
	struct kunit_kasan_expectation *kasan_data;

	resource = kunit_find_named_resource(cur_test, "kasan_data");

	if (!resource) {
		kunit_set_failure(cur_test);
		return;
	}

	kasan_data = (struct kunit_kasan_expectation *)resource->data;
337
	WRITE_ONCE(kasan_data->report_found, true);
Patricia Alfonso's avatar
Patricia Alfonso committed
338
339
340
341
	kunit_put_resource(resource);
}
#endif /* IS_ENABLED(CONFIG_KUNIT) */

342
void kasan_report_invalid_free(void *object, unsigned long ip)
343
344
{
	unsigned long flags;
345
	u8 tag = get_tag(object);
346

347
	object = kasan_reset_tag(object);
Patricia Alfonso's avatar
Patricia Alfonso committed
348
349
350
351
352
353

#if IS_ENABLED(CONFIG_KUNIT)
	if (current->kunit_test)
		kasan_update_kunit_status(current->kunit_test);
#endif /* IS_ENABLED(CONFIG_KUNIT) */

354
	start_report(&flags);
355
	pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
356
	kasan_print_tags(tag, object);
357
	pr_err("\n");
358
	print_address_description(object, tag);
359
	pr_err("\n");
360
	print_memory_metadata(object);
361
	end_report(&flags, (unsigned long)object);
362
363
}

364
365
366
367
368
#ifdef CONFIG_KASAN_HW_TAGS
void kasan_report_async(void)
{
	unsigned long flags;

369
370
371
372
373
#if IS_ENABLED(CONFIG_KUNIT)
	if (current->kunit_test)
		kasan_update_kunit_status(current->kunit_test);
#endif /* IS_ENABLED(CONFIG_KUNIT) */

374
375
376
377
378
379
380
381
382
	start_report(&flags);
	pr_err("BUG: KASAN: invalid-access\n");
	pr_err("Asynchronous mode enabled: no access details available\n");
	pr_err("\n");
	dump_stack();
	end_report(&flags, 0);
}
#endif /* CONFIG_KASAN_HW_TAGS */

383
384
static void __kasan_report(unsigned long addr, size_t size, bool is_write,
				unsigned long ip)
385
386
{
	struct kasan_access_info info;
387
388
389
	void *tagged_addr;
	void *untagged_addr;
	unsigned long flags;
390

Patricia Alfonso's avatar
Patricia Alfonso committed
391
392
393
394
395
#if IS_ENABLED(CONFIG_KUNIT)
	if (current->kunit_test)
		kasan_update_kunit_status(current->kunit_test);
#endif /* IS_ENABLED(CONFIG_KUNIT) */

396
397
	disable_trace_on_warning();

398
	tagged_addr = (void *)addr;
399
	untagged_addr = kasan_reset_tag(tagged_addr);
400
401

	info.access_addr = tagged_addr;
402
	if (addr_has_metadata(untagged_addr))
403
404
		info.first_bad_addr =
			kasan_find_first_bad_addr(tagged_addr, size);
405
406
	else
		info.first_bad_addr = untagged_addr;
407
408
409
	info.access_size = size;
	info.is_write = is_write;
	info.ip = ip;
410

411
412
413
	start_report(&flags);

	print_error_description(&info);
414
	if (addr_has_metadata(untagged_addr))
415
		kasan_print_tags(get_tag(tagged_addr), info.first_bad_addr);
416
417
	pr_err("\n");

418
	if (addr_has_metadata(untagged_addr)) {
419
		print_address_description(untagged_addr, get_tag(tagged_addr));
420
		pr_err("\n");
421
		print_memory_metadata(info.first_bad_addr);
422
423
424
425
	} else {
		dump_stack();
	}

426
	end_report(&flags, addr);
427
}
428

429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
bool kasan_report(unsigned long addr, size_t size, bool is_write,
			unsigned long ip)
{
	unsigned long flags = user_access_save();
	bool ret = false;

	if (likely(report_enabled())) {
		__kasan_report(addr, size, is_write, ip);
		ret = true;
	}

	user_access_restore(flags);

	return ret;
}

445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
#ifdef CONFIG_KASAN_INLINE
/*
 * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high
 * canonical half of the address space) cause out-of-bounds shadow memory reads
 * before the actual access. For addresses in the low canonical half of the
 * address space, as well as most non-canonical addresses, that out-of-bounds
 * shadow memory access lands in the non-canonical part of the address space.
 * Help the user figure out what the original bogus pointer was.
 */
void kasan_non_canonical_hook(unsigned long addr)
{
	unsigned long orig_addr;
	const char *bug_type;

	if (addr < KASAN_SHADOW_OFFSET)
		return;

	orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT;
	/*
	 * For faults near the shadow address for NULL, we can be fairly certain
	 * that this is a KASAN shadow memory access.
	 * For faults that correspond to shadow for low canonical addresses, we
	 * can still be pretty sure - that shadow region is a fairly narrow
	 * chunk of the non-canonical address space.
	 * But faults that look like shadow for non-canonical addresses are a
	 * really large chunk of the address space. In that case, we still
	 * print the decoded address, but make it clear that this is not
	 * necessarily what's actually going on.
	 */
	if (orig_addr < PAGE_SIZE)
		bug_type = "null-ptr-deref";
	else if (orig_addr < TASK_SIZE)
		bug_type = "probably user-memory-access";
	else
		bug_type = "maybe wild-memory-access";
	pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,
481
		 orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1);
482
483
}
#endif