Release 4.13 mm/kasan/report.c

Directory: mm/kasan
/*
 * This file contains error reporting code.
 *
 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
 *
 * Some code borrowed from https://github.com/xairy/kasan-prototype by
 *        Andrey Konovalov <adech.fo@gmail.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 */

#include <linux/bitops.h>
#include <linux/ftrace.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/printk.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/stackdepot.h>
#include <linux/stacktrace.h>
#include <linux/string.h>
#include <linux/types.h>
#include <linux/kasan.h>
#include <linux/module.h>

#include <asm/sections.h>

#include "kasan.h"
#include "../slab.h"

/* Shadow layout customization. */

#define SHADOW_BYTES_PER_BLOCK 1

#define SHADOW_BLOCKS_PER_ROW 16

#define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK)

#define SHADOW_ROWS_AROUND_ADDR 2



static const void *find_first_bad_addr(const void *addr, size_t size)
{
	u8 shadow_val = *(u8 *)kasan_mem_to_shadow(addr);
	const void *first_bad_addr = addr;

	while (!shadow_val && first_bad_addr < addr + size) {
		first_bad_addr += KASAN_SHADOW_SCALE_SIZE;
		shadow_val = *(u8 *)kasan_mem_to_shadow(first_bad_addr);
	}
	return first_bad_addr;
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 68 100.00% 1 100.00%
Total 68 100.00% 1 100.00%



static bool addr_has_shadow(struct kasan_access_info *info)
{
	return (info->access_addr >=
		kasan_shadow_to_mem((void *)KASAN_SHADOW_START));
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 25 92.59% 1 50.00%
Andrey Ryabinin 2 7.41% 1 50.00%
Total 27 100.00% 2 100.00%



static const char *get_shadow_bug_type(struct kasan_access_info *info)
{
	const char *bug_type = "unknown-crash";
	u8 *shadow_addr;

	info->first_bad_addr = find_first_bad_addr(info->access_addr,
						info->access_size);

	shadow_addr = (u8 *)kasan_mem_to_shadow(info->first_bad_addr);

	/*
         * If shadow byte value is in [0, KASAN_SHADOW_SCALE_SIZE) we can look
         * at the next shadow byte to determine the type of the bad access.
         */
	if (*shadow_addr > 0 && *shadow_addr <= KASAN_SHADOW_SCALE_SIZE - 1)
		shadow_addr++;

	switch (*shadow_addr) {
	case 0 ... KASAN_SHADOW_SCALE_SIZE - 1:
		/*
                 * In theory it's still possible to see these shadow values
                 * due to a data race in the kernel code.
                 */
		bug_type = "out-of-bounds";
		break;
	case KASAN_PAGE_REDZONE:
	case KASAN_KMALLOC_REDZONE:
		bug_type = "slab-out-of-bounds";
		break;
	case KASAN_GLOBAL_REDZONE:
		bug_type = "global-out-of-bounds";
		break;
	case KASAN_STACK_LEFT:
	case KASAN_STACK_MID:
	case KASAN_STACK_RIGHT:
	case KASAN_STACK_PARTIAL:
		bug_type = "stack-out-of-bounds";
		break;
	case KASAN_FREE_PAGE:
	case KASAN_KMALLOC_FREE:
		bug_type = "use-after-free";
		break;
	case KASAN_USE_AFTER_SCOPE:
		bug_type = "use-after-scope";
		break;
	}

	return bug_type;
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 82 55.41% 5 55.56%
Andrey Konovalov 58 39.19% 3 33.33%
Dmitriy Vyukov 8 5.41% 1 11.11%
Total 148 100.00% 9 100.00%



static const char *get_wild_bug_type(struct kasan_access_info *info)
{
	const char *bug_type = "unknown-crash";

	if ((unsigned long)info->access_addr < PAGE_SIZE)
		bug_type = "null-ptr-deref";
	else if ((unsigned long)info->access_addr < TASK_SIZE)
		bug_type = "user-memory-access";
	else
		bug_type = "wild-memory-access";

	return bug_type;
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 60 98.36% 1 50.00%
Colin Ian King 1 1.64% 1 50.00%
Total 61 100.00% 2 100.00%



static const char *get_bug_type(struct kasan_access_info *info)
{
	if (addr_has_shadow(info))
		return get_shadow_bug_type(info);
	return get_wild_bug_type(info);
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 32 100.00% 1 100.00%
Total 32 100.00% 1 100.00%



static void print_error_description(struct kasan_access_info *info)
{
	const char *bug_type = get_bug_type(info);

	pr_err("BUG: KASAN: %s in %pS\n",
		bug_type, (void *)info->ip);
	pr_err("%s of size %zu at addr %p by task %s/%d\n",
		info->is_write ? "Write" : "Read", info->access_size,
		info->access_addr, current->comm, task_pid_nr(current));
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 40 60.61% 1 25.00%
Andrey Konovalov 26 39.39% 3 75.00%
Total 66 100.00% 4 100.00%



static inline bool kernel_or_module_addr(const void *addr)
{
	if (addr >= (void *)_stext && addr < (void *)_end)
		return true;
	if (is_module_address((unsigned long)addr))
		return true;
	return false;
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 31 62.00% 1 50.00%
Aneesh Kumar K.V 19 38.00% 1 50.00%
Total 50 100.00% 2 100.00%



static inline bool init_task_stack_addr(const void *addr)
{
	return addr >= (void *)&init_thread_union.stack &&
		(addr <= (void *)&init_thread_union.stack +
			sizeof(init_thread_union.stack));
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 44 100.00% 1 100.00%
Total 44 100.00% 1 100.00%

static DEFINE_SPINLOCK(report_lock);



static void kasan_start_report(unsigned long *flags)
{
	/*
         * Make sure we don't end up in loop.
         */
	kasan_disable_current();
	spin_lock_irqsave(&report_lock, *flags);
	pr_err("==================================================================\n");
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 29 100.00% 1 100.00%
Total 29 100.00% 1 100.00%



static void kasan_end_report(unsigned long *flags)
{
	pr_err("==================================================================\n");
	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
	spin_unlock_irqrestore(&report_lock, *flags);
	if (panic_on_warn)
		panic("panic_on_warn set ...\n");
	kasan_enable_current();
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 35 79.55% 1 50.00%
Dmitriy Vyukov 9 20.45% 1 50.00%
Total 44 100.00% 2 100.00%



static void print_track(struct kasan_track *track, const char *prefix)
{
	pr_err("%s by task %u:\n", prefix, track->pid);
	if (track->stack) {
		struct stack_trace trace;

		depot_fetch_stack(track->stack, &trace);
		print_stack_trace(&trace, 0);
	} else {
		pr_err("(stack is not available)\n");
	}
}

Contributors
Person Tokens Prop Commits CommitProp
Alexander Potapenko 57 87.69% 2 66.67%
Andrey Konovalov 8 12.31% 1 33.33%
Total 65 100.00% 3 100.00%



static struct page *addr_to_page(const void *addr)
{
	if ((addr >= (void *)PAGE_OFFSET) &&
			(addr < high_memory))
		return virt_to_head_page(addr);
	return NULL;
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 38 95.00% 1 50.00%
Alexander Potapenko 2 5.00% 1 50.00%
Total 40 100.00% 2 100.00%



static void describe_object_addr(struct kmem_cache *cache, void *object,
				const void *addr)
{
	unsigned long access_addr = (unsigned long)addr;
	unsigned long object_addr = (unsigned long)object;
	const char *rel_type;
	int rel_bytes;

	pr_err("The buggy address belongs to the object at %p\n"
	       " which belongs to the cache %s of size %d\n",
		object, cache->name, cache->object_size);

	if (!addr)
		return;

	if (access_addr < object_addr) {
		rel_type = "to the left";
		rel_bytes = object_addr - access_addr;
	} else if (access_addr >= object_addr + cache->object_size) {
		rel_type = "to the right";
		rel_bytes = access_addr - (object_addr + cache->object_size);
	} else {
		rel_type = "inside";
		rel_bytes = access_addr - object_addr;
	}

	pr_err("The buggy address is located %d bytes %s of\n"
	       " %d-byte region [%p, %p)\n",
		rel_bytes, rel_type, cache->object_size, (void *)object_addr,
		(void *)(object_addr + cache->object_size));
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 130 80.25% 2 50.00%
Alexander Potapenko 28 17.28% 1 25.00%
Andrey Ryabinin 4 2.47% 1 25.00%
Total 162 100.00% 4 100.00%



static void describe_object(struct kmem_cache *cache, void *object,
				const void *addr)
{
	struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);

	if (cache->flags & SLAB_KASAN) {
		print_track(&alloc_info->alloc_track, "Allocated");
		pr_err("\n");
		print_track(&alloc_info->free_track, "Freed");
		pr_err("\n");
	}

	describe_object_addr(cache, object, addr);
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 58 71.60% 3 60.00%
Alexander Potapenko 21 25.93% 1 20.00%
Andrey Ryabinin 2 2.47% 1 20.00%
Total 81 100.00% 5 100.00%



static void print_address_description(void *addr)
{
	struct page *page = addr_to_page(addr);

	dump_stack();
	pr_err("\n");

	if (page && PageSlab(page)) {
		struct kmem_cache *cache = page->slab_cache;
		void *object = nearest_obj(cache, page,	addr);

		describe_object(cache, object, addr);
	}

	if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) {
		pr_err("The buggy address belongs to the variable:\n");
		pr_err(" %pS\n", addr);
	}

	if (page) {
		pr_err("The buggy address belongs to the page:\n");
		dump_page(page, "kasan: bad access detected");
	}
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 65 56.52% 4 40.00%
Andrey Konovalov 49 42.61% 5 50.00%
Alexander Potapenko 1 0.87% 1 10.00%
Total 115 100.00% 10 100.00%



static bool row_is_guilty(const void *row, const void *guilty)
{
	return (row <= guilty) && (guilty < row + SHADOW_BYTES_PER_ROW);
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 31 100.00% 1 100.00%
Total 31 100.00% 1 100.00%



static int shadow_pointer_offset(const void *row, const void *shadow)
{
	/* The length of ">ff00ff00ff00ff00: " is
         *    3 + (BITS_PER_LONG/8)*2 chars.
         */
	return 3 + (BITS_PER_LONG/8)*2 + (shadow - row)*2 +
		(shadow - row) / SHADOW_BYTES_PER_BLOCK + 1;
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 46 100.00% 1 100.00%
Total 46 100.00% 1 100.00%



static void print_shadow_for_address(const void *addr)
{
	int i;
	const void *shadow = kasan_mem_to_shadow(addr);
	const void *shadow_row;

	shadow_row = (void *)round_down((unsigned long)shadow,
					SHADOW_BYTES_PER_ROW)
		- SHADOW_ROWS_AROUND_ADDR * SHADOW_BYTES_PER_ROW;

	pr_err("Memory state around the buggy address:\n");

	for (i = -SHADOW_ROWS_AROUND_ADDR; i <= SHADOW_ROWS_AROUND_ADDR; i++) {
		const void *kaddr = kasan_shadow_to_mem(shadow_row);
		char buffer[4 + (BITS_PER_LONG/8)*2];
		char shadow_buf[SHADOW_BYTES_PER_ROW];

		snprintf(buffer, sizeof(buffer),
			(i == 0) ? ">%p: " : " %p: ", kaddr);
		/*
                 * We should not pass a shadow pointer to generic
                 * function, because generic functions may try to
                 * access kasan mapping for the passed address.
                 */
		memcpy(shadow_buf, shadow_row, SHADOW_BYTES_PER_ROW);
		print_hex_dump(KERN_ERR, buffer,
			DUMP_PREFIX_NONE, SHADOW_BYTES_PER_ROW, 1,
			shadow_buf, SHADOW_BYTES_PER_ROW, 0);

		if (row_is_guilty(shadow_row, shadow))
			pr_err("%*c\n",
				shadow_pointer_offset(shadow_row, shadow),
				'^');

		shadow_row += SHADOW_BYTES_PER_ROW;
	}
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 162 90.50% 1 50.00%
Aneesh Kumar K.V 17 9.50% 1 50.00%
Total 179 100.00% 2 100.00%



void kasan_report_double_free(struct kmem_cache *cache, void *object,
				void *ip)
{
	unsigned long flags;

	kasan_start_report(&flags);
	pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", ip);
	pr_err("\n");
	print_address_description(object);
	pr_err("\n");
	print_shadow_for_address(object);
	kasan_end_report(&flags);
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 61 100.00% 2 100.00%
Total 61 100.00% 2 100.00%



static void kasan_report_error(struct kasan_access_info *info)
{
	unsigned long flags;

	kasan_start_report(&flags);

	print_error_description(info);
	pr_err("\n");

	if (!addr_has_shadow(info)) {
		dump_stack();
	} else {
		print_address_description((void *)info->access_addr);
		pr_err("\n");
		print_shadow_for_address(info->first_bad_addr);
	}

	kasan_end_report(&flags);
}

Contributors
Person Tokens Prop Commits CommitProp
Andrey Konovalov 45 59.21% 5 71.43%
Andrey Ryabinin 31 40.79% 2 28.57%
Total 76 100.00% 7 100.00%


static unsigned long kasan_flags;


#define KASAN_BIT_REPORTED	0

#define KASAN_BIT_MULTI_SHOT	1



bool kasan_save_enable_multi_shot(void)
{
	return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
}
Contributors
Person Tokens Prop Commits CommitProp
Mark Rutland 16 100.00% 1 100.00%
Total 16 100.00% 1 100.00%


EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);



void kasan_restore_multi_shot(bool enabled)
{
	if (!enabled)
		clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
}
Contributors
Person Tokens Prop Commits CommitProp
Mark Rutland 21 100.00% 1 100.00%
Total 21 100.00% 1 100.00%


EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);



static int __init kasan_set_multi_shot(char *str)
{
	set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
	return 1;
}
Contributors
Person Tokens Prop Commits CommitProp
Mark Rutland 22 100.00% 1 100.00%
Total 22 100.00% 1 100.00%

__setup("kasan_multi_shot", kasan_set_multi_shot);



static inline bool kasan_report_enabled(void)
{
	if (current->kasan_depth)
		return false;
	if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
		return true;
	return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
}

Contributors
Person Tokens Prop Commits CommitProp
Mark Rutland 41 100.00% 1 100.00%
Total 41 100.00% 1 100.00%



void kasan_report(unsigned long addr, size_t size,
		bool is_write, unsigned long ip)
{
	struct kasan_access_info info;

	if (likely(!kasan_report_enabled()))
		return;

	disable_trace_on_warning();

	info.access_addr = (void *)addr;
	info.first_bad_addr = (void *)addr;
	info.access_size = size;
	info.is_write = is_write;
	info.ip = ip;

	kasan_report_error(&info);
}


Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 66 82.50% 1 25.00%
Arnd Bergmann 10 12.50% 1 25.00%
Peter Zijlstra 3 3.75% 1 25.00%
Aneesh Kumar K.V 1 1.25% 1 25.00%
Total 80 100.00% 4 100.00%


#define DEFINE_ASAN_REPORT_LOAD(size)                     \
void __asan_report_load##size##_noabort(unsigned long addr) \
{                                                         \
        kasan_report(addr, size, false, _RET_IP_);        \
}                                                         \
EXPORT_SYMBOL(__asan_report_load##size##_noabort)


#define DEFINE_ASAN_REPORT_STORE(size)                     \
void __asan_report_store##size##_noabort(unsigned long addr) \
{                                                          \
        kasan_report(addr, size, true, _RET_IP_);          \
}                                                          \
EXPORT_SYMBOL(__asan_report_store##size##_noabort)

DEFINE_ASAN_REPORT_LOAD(1);
DEFINE_ASAN_REPORT_LOAD(2);
DEFINE_ASAN_REPORT_LOAD(4);
DEFINE_ASAN_REPORT_LOAD(8);
DEFINE_ASAN_REPORT_LOAD(16);
DEFINE_ASAN_REPORT_STORE(1);
DEFINE_ASAN_REPORT_STORE(2);
DEFINE_ASAN_REPORT_STORE(4);
DEFINE_ASAN_REPORT_STORE(8);
DEFINE_ASAN_REPORT_STORE(16);



void __asan_report_load_n_noabort(unsigned long addr, size_t size)
{
	kasan_report(addr, size, false, _RET_IP_);
}
Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 23 100.00% 1 100.00%
Total 23 100.00% 1 100.00%


EXPORT_SYMBOL(__asan_report_load_n_noabort);



void __asan_report_store_n_noabort(unsigned long addr, size_t size)
{
	kasan_report(addr, size, true, _RET_IP_);
}
Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 23 100.00% 1 100.00%
Total 23 100.00% 1 100.00%


EXPORT_SYMBOL(__asan_report_store_n_noabort);
Overall Contributors
Person Tokens Prop Commits CommitProp
Andrey Ryabinin 919 50.16% 8 25.00%
Andrey Konovalov 591 32.26% 13 40.62%
Mark Rutland 136 7.42% 1 3.12%
Alexander Potapenko 112 6.11% 2 6.25%
Aneesh Kumar K.V 40 2.18% 3 9.38%
Dmitriy Vyukov 17 0.93% 2 6.25%
Arnd Bergmann 10 0.55% 1 3.12%
Peter Zijlstra 6 0.33% 1 3.12%
Colin Ian King 1 0.05% 1 3.12%
Total 1832 100.00% 32 100.00%
Directory: mm/kasan

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with cregit.
Person	Tokens	Prop	Commits	CommitProp
Andrey Ryabinin	68	100.00%	1	100.00%
Total	68	100.00%	1	100.00%
cregit-Linux how code gets into the kernel

Release 4.13 mm/kasan/report.c

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Overall Contributors
