Andrey Ryabinin | 0b24bec | 2015-02-13 14:39:17 -0800 | [diff] [blame] | 1 | /* |
| 2 | * This file contains error reporting code. |
| 3 | * |
| 4 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. |
| 5 | * Author: Andrey Ryabinin <a.ryabinin@samsung.com> |
| 6 | * |
| 7 | * Some of code borrowed from https://github.com/xairy/linux by |
| 8 | * Andrey Konovalov <adech.fo@gmail.com> |
| 9 | * |
| 10 | * This program is free software; you can redistribute it and/or modify |
| 11 | * it under the terms of the GNU General Public License version 2 as |
| 12 | * published by the Free Software Foundation. |
| 13 | * |
| 14 | */ |
| 15 | |
| 16 | #include <linux/kernel.h> |
| 17 | #include <linux/mm.h> |
| 18 | #include <linux/printk.h> |
| 19 | #include <linux/sched.h> |
| 20 | #include <linux/slab.h> |
| 21 | #include <linux/stacktrace.h> |
| 22 | #include <linux/string.h> |
| 23 | #include <linux/types.h> |
| 24 | #include <linux/kasan.h> |
| 25 | |
| 26 | #include "kasan.h" |
| 27 | |
| 28 | /* Shadow layout customization. */ |
| 29 | #define SHADOW_BYTES_PER_BLOCK 1 |
| 30 | #define SHADOW_BLOCKS_PER_ROW 16 |
| 31 | #define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK) |
| 32 | #define SHADOW_ROWS_AROUND_ADDR 2 |
| 33 | |
| 34 | static const void *find_first_bad_addr(const void *addr, size_t size) |
| 35 | { |
| 36 | u8 shadow_val = *(u8 *)kasan_mem_to_shadow(addr); |
| 37 | const void *first_bad_addr = addr; |
| 38 | |
| 39 | while (!shadow_val && first_bad_addr < addr + size) { |
| 40 | first_bad_addr += KASAN_SHADOW_SCALE_SIZE; |
| 41 | shadow_val = *(u8 *)kasan_mem_to_shadow(first_bad_addr); |
| 42 | } |
| 43 | return first_bad_addr; |
| 44 | } |
| 45 | |
| 46 | static void print_error_description(struct kasan_access_info *info) |
| 47 | { |
| 48 | const char *bug_type = "unknown crash"; |
| 49 | u8 shadow_val; |
| 50 | |
| 51 | info->first_bad_addr = find_first_bad_addr(info->access_addr, |
| 52 | info->access_size); |
| 53 | |
| 54 | shadow_val = *(u8 *)kasan_mem_to_shadow(info->first_bad_addr); |
| 55 | |
| 56 | switch (shadow_val) { |
Andrey Ryabinin | b8c73fc | 2015-02-13 14:39:28 -0800 | [diff] [blame^] | 57 | case KASAN_FREE_PAGE: |
| 58 | bug_type = "use after free"; |
| 59 | break; |
Andrey Ryabinin | 0b24bec | 2015-02-13 14:39:17 -0800 | [diff] [blame] | 60 | case 0 ... KASAN_SHADOW_SCALE_SIZE - 1: |
| 61 | bug_type = "out of bounds access"; |
| 62 | break; |
| 63 | } |
| 64 | |
| 65 | pr_err("BUG: KASan: %s in %pS at addr %p\n", |
| 66 | bug_type, (void *)info->ip, |
| 67 | info->access_addr); |
| 68 | pr_err("%s of size %zu by task %s/%d\n", |
| 69 | info->is_write ? "Write" : "Read", |
| 70 | info->access_size, current->comm, task_pid_nr(current)); |
| 71 | } |
| 72 | |
| 73 | static void print_address_description(struct kasan_access_info *info) |
| 74 | { |
Andrey Ryabinin | b8c73fc | 2015-02-13 14:39:28 -0800 | [diff] [blame^] | 75 | const void *addr = info->access_addr; |
| 76 | |
| 77 | if ((addr >= (void *)PAGE_OFFSET) && |
| 78 | (addr < high_memory)) { |
| 79 | struct page *page = virt_to_head_page(addr); |
| 80 | dump_page(page, "kasan: bad access detected"); |
| 81 | } |
| 82 | |
Andrey Ryabinin | 0b24bec | 2015-02-13 14:39:17 -0800 | [diff] [blame] | 83 | dump_stack(); |
| 84 | } |
| 85 | |
| 86 | static bool row_is_guilty(const void *row, const void *guilty) |
| 87 | { |
| 88 | return (row <= guilty) && (guilty < row + SHADOW_BYTES_PER_ROW); |
| 89 | } |
| 90 | |
| 91 | static int shadow_pointer_offset(const void *row, const void *shadow) |
| 92 | { |
| 93 | /* The length of ">ff00ff00ff00ff00: " is |
| 94 | * 3 + (BITS_PER_LONG/8)*2 chars. |
| 95 | */ |
| 96 | return 3 + (BITS_PER_LONG/8)*2 + (shadow - row)*2 + |
| 97 | (shadow - row) / SHADOW_BYTES_PER_BLOCK + 1; |
| 98 | } |
| 99 | |
| 100 | static void print_shadow_for_address(const void *addr) |
| 101 | { |
| 102 | int i; |
| 103 | const void *shadow = kasan_mem_to_shadow(addr); |
| 104 | const void *shadow_row; |
| 105 | |
| 106 | shadow_row = (void *)round_down((unsigned long)shadow, |
| 107 | SHADOW_BYTES_PER_ROW) |
| 108 | - SHADOW_ROWS_AROUND_ADDR * SHADOW_BYTES_PER_ROW; |
| 109 | |
| 110 | pr_err("Memory state around the buggy address:\n"); |
| 111 | |
| 112 | for (i = -SHADOW_ROWS_AROUND_ADDR; i <= SHADOW_ROWS_AROUND_ADDR; i++) { |
| 113 | const void *kaddr = kasan_shadow_to_mem(shadow_row); |
| 114 | char buffer[4 + (BITS_PER_LONG/8)*2]; |
| 115 | |
| 116 | snprintf(buffer, sizeof(buffer), |
| 117 | (i == 0) ? ">%p: " : " %p: ", kaddr); |
| 118 | |
| 119 | kasan_disable_current(); |
| 120 | print_hex_dump(KERN_ERR, buffer, |
| 121 | DUMP_PREFIX_NONE, SHADOW_BYTES_PER_ROW, 1, |
| 122 | shadow_row, SHADOW_BYTES_PER_ROW, 0); |
| 123 | kasan_enable_current(); |
| 124 | |
| 125 | if (row_is_guilty(shadow_row, shadow)) |
| 126 | pr_err("%*c\n", |
| 127 | shadow_pointer_offset(shadow_row, shadow), |
| 128 | '^'); |
| 129 | |
| 130 | shadow_row += SHADOW_BYTES_PER_ROW; |
| 131 | } |
| 132 | } |
| 133 | |
| 134 | static DEFINE_SPINLOCK(report_lock); |
| 135 | |
| 136 | void kasan_report_error(struct kasan_access_info *info) |
| 137 | { |
| 138 | unsigned long flags; |
| 139 | |
| 140 | spin_lock_irqsave(&report_lock, flags); |
| 141 | pr_err("=================================" |
| 142 | "=================================\n"); |
| 143 | print_error_description(info); |
| 144 | print_address_description(info); |
| 145 | print_shadow_for_address(info->first_bad_addr); |
| 146 | pr_err("=================================" |
| 147 | "=================================\n"); |
| 148 | spin_unlock_irqrestore(&report_lock, flags); |
| 149 | } |
| 150 | |
| 151 | void kasan_report_user_access(struct kasan_access_info *info) |
| 152 | { |
| 153 | unsigned long flags; |
| 154 | |
| 155 | spin_lock_irqsave(&report_lock, flags); |
| 156 | pr_err("=================================" |
| 157 | "=================================\n"); |
| 158 | pr_err("BUG: KASan: user-memory-access on address %p\n", |
| 159 | info->access_addr); |
| 160 | pr_err("%s of size %zu by task %s/%d\n", |
| 161 | info->is_write ? "Write" : "Read", |
| 162 | info->access_size, current->comm, task_pid_nr(current)); |
| 163 | dump_stack(); |
| 164 | pr_err("=================================" |
| 165 | "=================================\n"); |
| 166 | spin_unlock_irqrestore(&report_lock, flags); |
| 167 | } |
| 168 | |
| 169 | void kasan_report(unsigned long addr, size_t size, |
| 170 | bool is_write, unsigned long ip) |
| 171 | { |
| 172 | struct kasan_access_info info; |
| 173 | |
| 174 | if (likely(!kasan_enabled())) |
| 175 | return; |
| 176 | |
| 177 | info.access_addr = (void *)addr; |
| 178 | info.access_size = size; |
| 179 | info.is_write = is_write; |
| 180 | info.ip = ip; |
| 181 | kasan_report_error(&info); |
| 182 | } |
| 183 | |
| 184 | |
| 185 | #define DEFINE_ASAN_REPORT_LOAD(size) \ |
| 186 | void __asan_report_load##size##_noabort(unsigned long addr) \ |
| 187 | { \ |
| 188 | kasan_report(addr, size, false, _RET_IP_); \ |
| 189 | } \ |
| 190 | EXPORT_SYMBOL(__asan_report_load##size##_noabort) |
| 191 | |
| 192 | #define DEFINE_ASAN_REPORT_STORE(size) \ |
| 193 | void __asan_report_store##size##_noabort(unsigned long addr) \ |
| 194 | { \ |
| 195 | kasan_report(addr, size, true, _RET_IP_); \ |
| 196 | } \ |
| 197 | EXPORT_SYMBOL(__asan_report_store##size##_noabort) |
| 198 | |
| 199 | DEFINE_ASAN_REPORT_LOAD(1); |
| 200 | DEFINE_ASAN_REPORT_LOAD(2); |
| 201 | DEFINE_ASAN_REPORT_LOAD(4); |
| 202 | DEFINE_ASAN_REPORT_LOAD(8); |
| 203 | DEFINE_ASAN_REPORT_LOAD(16); |
| 204 | DEFINE_ASAN_REPORT_STORE(1); |
| 205 | DEFINE_ASAN_REPORT_STORE(2); |
| 206 | DEFINE_ASAN_REPORT_STORE(4); |
| 207 | DEFINE_ASAN_REPORT_STORE(8); |
| 208 | DEFINE_ASAN_REPORT_STORE(16); |
| 209 | |
| 210 | void __asan_report_load_n_noabort(unsigned long addr, size_t size) |
| 211 | { |
| 212 | kasan_report(addr, size, false, _RET_IP_); |
| 213 | } |
| 214 | EXPORT_SYMBOL(__asan_report_load_n_noabort); |
| 215 | |
| 216 | void __asan_report_store_n_noabort(unsigned long addr, size_t size) |
| 217 | { |
| 218 | kasan_report(addr, size, true, _RET_IP_); |
| 219 | } |
| 220 | EXPORT_SYMBOL(__asan_report_store_n_noabort); |