xref: /openbmc/linux/mm/kmsan/report.c (revision f80be457)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * KMSAN error reporting routines.
4  *
5  * Copyright (C) 2019-2022 Google LLC
6  * Author: Alexander Potapenko <glider@google.com>
7  *
8  */
9 
10 #include <linux/console.h>
11 #include <linux/moduleparam.h>
12 #include <linux/stackdepot.h>
13 #include <linux/stacktrace.h>
14 #include <linux/uaccess.h>
15 
16 #include "kmsan.h"
17 
18 static DEFINE_RAW_SPINLOCK(kmsan_report_lock);
19 #define DESCR_SIZE 128
20 /* Protected by kmsan_report_lock */
21 static char report_local_descr[DESCR_SIZE];
22 int panic_on_kmsan __read_mostly;
23 
24 #ifdef MODULE_PARAM_PREFIX
25 #undef MODULE_PARAM_PREFIX
26 #endif
27 #define MODULE_PARAM_PREFIX "kmsan."
28 module_param_named(panic, panic_on_kmsan, int, 0);
29 
30 /*
31  * Skip internal KMSAN frames.
32  */
get_stack_skipnr(const unsigned long stack_entries[],int num_entries)33 static int get_stack_skipnr(const unsigned long stack_entries[],
34 			    int num_entries)
35 {
36 	int len, skip;
37 	char buf[64];
38 
39 	for (skip = 0; skip < num_entries; ++skip) {
40 		len = scnprintf(buf, sizeof(buf), "%ps",
41 				(void *)stack_entries[skip]);
42 
43 		/* Never show __msan_* or kmsan_* functions. */
44 		if ((strnstr(buf, "__msan_", len) == buf) ||
45 		    (strnstr(buf, "kmsan_", len) == buf))
46 			continue;
47 
48 		/*
49 		 * No match for runtime functions -- @skip entries to skip to
50 		 * get to first frame of interest.
51 		 */
52 		break;
53 	}
54 
55 	return skip;
56 }
57 
58 /*
59  * Currently the descriptions of locals generated by Clang look as follows:
60  *   ----local_name@function_name
61  * We want to print only the name of the local, as other information in that
62  * description can be confusing.
63  * The meaningful part of the description is copied to a global buffer to avoid
64  * allocating memory.
65  */
pretty_descr(char * descr)66 static char *pretty_descr(char *descr)
67 {
68 	int pos = 0, len = strlen(descr);
69 
70 	for (int i = 0; i < len; i++) {
71 		if (descr[i] == '@')
72 			break;
73 		if (descr[i] == '-')
74 			continue;
75 		report_local_descr[pos] = descr[i];
76 		if (pos + 1 == DESCR_SIZE)
77 			break;
78 		pos++;
79 	}
80 	report_local_descr[pos] = 0;
81 	return report_local_descr;
82 }
83 
kmsan_print_origin(depot_stack_handle_t origin)84 void kmsan_print_origin(depot_stack_handle_t origin)
85 {
86 	unsigned long *entries = NULL, *chained_entries = NULL;
87 	unsigned int nr_entries, chained_nr_entries, skipnr;
88 	void *pc1 = NULL, *pc2 = NULL;
89 	depot_stack_handle_t head;
90 	unsigned long magic;
91 	char *descr = NULL;
92 	unsigned int depth;
93 
94 	if (!origin)
95 		return;
96 
97 	while (true) {
98 		nr_entries = stack_depot_fetch(origin, &entries);
99 		depth = kmsan_depth_from_eb(stack_depot_get_extra_bits(origin));
100 		magic = nr_entries ? entries[0] : 0;
101 		if ((nr_entries == 4) && (magic == KMSAN_ALLOCA_MAGIC_ORIGIN)) {
102 			descr = (char *)entries[1];
103 			pc1 = (void *)entries[2];
104 			pc2 = (void *)entries[3];
105 			pr_err("Local variable %s created at:\n",
106 			       pretty_descr(descr));
107 			if (pc1)
108 				pr_err(" %pSb\n", pc1);
109 			if (pc2)
110 				pr_err(" %pSb\n", pc2);
111 			break;
112 		}
113 		if ((nr_entries == 3) && (magic == KMSAN_CHAIN_MAGIC_ORIGIN)) {
114 			/*
115 			 * Origin chains deeper than KMSAN_MAX_ORIGIN_DEPTH are
116 			 * not stored, so the output may be incomplete.
117 			 */
118 			if (depth == KMSAN_MAX_ORIGIN_DEPTH)
119 				pr_err("<Zero or more stacks not recorded to save memory>\n\n");
120 			head = entries[1];
121 			origin = entries[2];
122 			pr_err("Uninit was stored to memory at:\n");
123 			chained_nr_entries =
124 				stack_depot_fetch(head, &chained_entries);
125 			kmsan_internal_unpoison_memory(
126 				chained_entries,
127 				chained_nr_entries * sizeof(*chained_entries),
128 				/*checked*/ false);
129 			skipnr = get_stack_skipnr(chained_entries,
130 						  chained_nr_entries);
131 			stack_trace_print(chained_entries + skipnr,
132 					  chained_nr_entries - skipnr, 0);
133 			pr_err("\n");
134 			continue;
135 		}
136 		pr_err("Uninit was created at:\n");
137 		if (nr_entries) {
138 			skipnr = get_stack_skipnr(entries, nr_entries);
139 			stack_trace_print(entries + skipnr, nr_entries - skipnr,
140 					  0);
141 		} else {
142 			pr_err("(stack is not available)\n");
143 		}
144 		break;
145 	}
146 }
147 
kmsan_report(depot_stack_handle_t origin,void * address,int size,int off_first,int off_last,const void * user_addr,enum kmsan_bug_reason reason)148 void kmsan_report(depot_stack_handle_t origin, void *address, int size,
149 		  int off_first, int off_last, const void *user_addr,
150 		  enum kmsan_bug_reason reason)
151 {
152 	unsigned long stack_entries[KMSAN_STACK_DEPTH];
153 	int num_stack_entries, skipnr;
154 	char *bug_type = NULL;
155 	unsigned long ua_flags;
156 	bool is_uaf;
157 
158 	if (!kmsan_enabled)
159 		return;
160 	if (!current->kmsan_ctx.allow_reporting)
161 		return;
162 	if (!origin)
163 		return;
164 
165 	current->kmsan_ctx.allow_reporting = false;
166 	ua_flags = user_access_save();
167 	raw_spin_lock(&kmsan_report_lock);
168 	pr_err("=====================================================\n");
169 	is_uaf = kmsan_uaf_from_eb(stack_depot_get_extra_bits(origin));
170 	switch (reason) {
171 	case REASON_ANY:
172 		bug_type = is_uaf ? "use-after-free" : "uninit-value";
173 		break;
174 	case REASON_COPY_TO_USER:
175 		bug_type = is_uaf ? "kernel-infoleak-after-free" :
176 				    "kernel-infoleak";
177 		break;
178 	case REASON_SUBMIT_URB:
179 		bug_type = is_uaf ? "kernel-usb-infoleak-after-free" :
180 				    "kernel-usb-infoleak";
181 		break;
182 	}
183 
184 	num_stack_entries =
185 		stack_trace_save(stack_entries, KMSAN_STACK_DEPTH, 1);
186 	skipnr = get_stack_skipnr(stack_entries, num_stack_entries);
187 
188 	pr_err("BUG: KMSAN: %s in %pSb\n", bug_type,
189 	       (void *)stack_entries[skipnr]);
190 	stack_trace_print(stack_entries + skipnr, num_stack_entries - skipnr,
191 			  0);
192 	pr_err("\n");
193 
194 	kmsan_print_origin(origin);
195 
196 	if (size) {
197 		pr_err("\n");
198 		if (off_first == off_last)
199 			pr_err("Byte %d of %d is uninitialized\n", off_first,
200 			       size);
201 		else
202 			pr_err("Bytes %d-%d of %d are uninitialized\n",
203 			       off_first, off_last, size);
204 	}
205 	if (address)
206 		pr_err("Memory access of size %d starts at %px\n", size,
207 		       address);
208 	if (user_addr && reason == REASON_COPY_TO_USER)
209 		pr_err("Data copied to user address %px\n", user_addr);
210 	pr_err("\n");
211 	dump_stack_print_info(KERN_ERR);
212 	pr_err("=====================================================\n");
213 	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
214 	raw_spin_unlock(&kmsan_report_lock);
215 	if (panic_on_kmsan)
216 		panic("kmsan.panic set ...\n");
217 	user_access_restore(ua_flags);
218 	current->kmsan_ctx.allow_reporting = true;
219 }
220