1e886bf9dSAndrey Konovalov // SPDX-License-Identifier: GPL-2.0 20b24beccSAndrey Ryabinin /* 359fd51b2SAndrey Konovalov * This file contains common KASAN error reporting code. 40b24beccSAndrey Ryabinin * 50b24beccSAndrey Ryabinin * Copyright (c) 2014 Samsung Electronics Co., Ltd. 62baf9e89SAndrey Ryabinin * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> 70b24beccSAndrey Ryabinin * 85d0926efSAndrey Konovalov * Some code borrowed from https://github.com/xairy/kasan-prototype by 95f21f3a8SAndrey Konovalov * Andrey Konovalov <andreyknvl@gmail.com> 100b24beccSAndrey Ryabinin */ 110b24beccSAndrey Ryabinin 12b0845ce5SMark Rutland #include <linux/bitops.h> 134f40c6e5SPeter Zijlstra #include <linux/ftrace.h> 14b0845ce5SMark Rutland #include <linux/init.h> 150b24beccSAndrey Ryabinin #include <linux/kernel.h> 160b24beccSAndrey Ryabinin #include <linux/mm.h> 170b24beccSAndrey Ryabinin #include <linux/printk.h> 180b24beccSAndrey Ryabinin #include <linux/sched.h> 190b24beccSAndrey Ryabinin #include <linux/slab.h> 20cd11016eSAlexander Potapenko #include <linux/stackdepot.h> 210b24beccSAndrey Ryabinin #include <linux/stacktrace.h> 220b24beccSAndrey Ryabinin #include <linux/string.h> 230b24beccSAndrey Ryabinin #include <linux/types.h> 240b24beccSAndrey Ryabinin #include <linux/kasan.h> 25527f215bSAneesh Kumar K.V #include <linux/module.h> 26e8969219SMarco Elver #include <linux/sched/task_stack.h> 274fba3758SAndrey Konovalov #include <linux/uaccess.h> 280b24beccSAndrey Ryabinin 29bebf56a1SAndrey Ryabinin #include <asm/sections.h> 30bebf56a1SAndrey Ryabinin 3183c4e7a0SPatricia Alfonso #include <kunit/test.h> 3283c4e7a0SPatricia Alfonso 330b24beccSAndrey Ryabinin #include "kasan.h" 340316bec2SAndrey Ryabinin #include "../slab.h" 350b24beccSAndrey Ryabinin 3611cd3cd6SAndrey Konovalov static unsigned long kasan_flags; 3711cd3cd6SAndrey Konovalov 3811cd3cd6SAndrey Konovalov #define KASAN_BIT_REPORTED 0 3911cd3cd6SAndrey Konovalov #define KASAN_BIT_MULTI_SHOT 1 4011cd3cd6SAndrey Konovalov 4111cd3cd6SAndrey Konovalov bool kasan_save_enable_multi_shot(void) 420b24beccSAndrey Ryabinin { 4311cd3cd6SAndrey Konovalov return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags); 440b24beccSAndrey Ryabinin } 4511cd3cd6SAndrey Konovalov EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot); 460b24beccSAndrey Ryabinin 4711cd3cd6SAndrey Konovalov void kasan_restore_multi_shot(bool enabled) 485e82cd12SAndrey Konovalov { 4911cd3cd6SAndrey Konovalov if (!enabled) 5011cd3cd6SAndrey Konovalov clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags); 515e82cd12SAndrey Konovalov } 5211cd3cd6SAndrey Konovalov EXPORT_SYMBOL_GPL(kasan_restore_multi_shot); 535e82cd12SAndrey Konovalov 5411cd3cd6SAndrey Konovalov static int __init kasan_set_multi_shot(char *str) 550b24beccSAndrey Ryabinin { 5611cd3cd6SAndrey Konovalov set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags); 5711cd3cd6SAndrey Konovalov return 1; 580b24beccSAndrey Ryabinin } 5911cd3cd6SAndrey Konovalov __setup("kasan_multi_shot", kasan_set_multi_shot); 600b24beccSAndrey Ryabinin 61121e8f81SAndrey Konovalov static void print_error_description(struct kasan_access_info *info) 625e82cd12SAndrey Konovalov { 637f0a84c2SAndrey Konovalov pr_err("BUG: KASAN: %s in %pS\n", 64121e8f81SAndrey Konovalov get_bug_type(info), (void *)info->ip); 656424f6bbSTobin C. Harding pr_err("%s of size %zu at addr %px by task %s/%d\n", 667d418f7bSAndrey Konovalov info->is_write ? "Write" : "Read", info->access_size, 677f0a84c2SAndrey Konovalov info->access_addr, current->comm, task_pid_nr(current)); 680b24beccSAndrey Ryabinin } 690b24beccSAndrey Ryabinin 707e088978SAndrey Ryabinin static DEFINE_SPINLOCK(report_lock); 717e088978SAndrey Ryabinin 7211cd3cd6SAndrey Konovalov static void start_report(unsigned long *flags) 737e088978SAndrey Ryabinin { 747e088978SAndrey Ryabinin /* 757e088978SAndrey Ryabinin * Make sure we don't end up in loop. 767e088978SAndrey Ryabinin */ 777e088978SAndrey Ryabinin kasan_disable_current(); 787e088978SAndrey Ryabinin spin_lock_irqsave(&report_lock, *flags); 797e088978SAndrey Ryabinin pr_err("==================================================================\n"); 807e088978SAndrey Ryabinin } 817e088978SAndrey Ryabinin 8211cd3cd6SAndrey Konovalov static void end_report(unsigned long *flags) 837e088978SAndrey Ryabinin { 847e088978SAndrey Ryabinin pr_err("==================================================================\n"); 857e088978SAndrey Ryabinin add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); 867e088978SAndrey Ryabinin spin_unlock_irqrestore(&report_lock, *flags); 87be4f1ae9SDavid Gow if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) { 881d2252faSKees Cook /* 891d2252faSKees Cook * This thread may hit another WARN() in the panic path. 901d2252faSKees Cook * Resetting this prevents additional WARN() from panicking the 911d2252faSKees Cook * system on this thread. Other threads are blocked by the 921d2252faSKees Cook * panic_mutex in panic(). 931d2252faSKees Cook */ 941d2252faSKees Cook panic_on_warn = 0; 955c5c1f36SDmitry Vyukov panic("panic_on_warn set ...\n"); 961d2252faSKees Cook } 977e088978SAndrey Ryabinin kasan_enable_current(); 987e088978SAndrey Ryabinin } 997e088978SAndrey Ryabinin 10026e760c9SWalter Wu static void print_stack(depot_stack_handle_t stack) 10126e760c9SWalter Wu { 10226e760c9SWalter Wu unsigned long *entries; 10326e760c9SWalter Wu unsigned int nr_entries; 10426e760c9SWalter Wu 10526e760c9SWalter Wu nr_entries = stack_depot_fetch(stack, &entries); 10626e760c9SWalter Wu stack_trace_print(entries, nr_entries, 0); 10726e760c9SWalter Wu } 10826e760c9SWalter Wu 109b6b72f49SAndrey Konovalov static void print_track(struct kasan_track *track, const char *prefix) 1107ed2f9e6SAlexander Potapenko { 111b6b72f49SAndrey Konovalov pr_err("%s by task %u:\n", prefix, track->pid); 112cd11016eSAlexander Potapenko if (track->stack) { 11326e760c9SWalter Wu print_stack(track->stack); 114cd11016eSAlexander Potapenko } else { 115cd11016eSAlexander Potapenko pr_err("(stack is not available)\n"); 116cd11016eSAlexander Potapenko } 1177ed2f9e6SAlexander Potapenko } 1187ed2f9e6SAlexander Potapenko 119ae8f06b3SWalter Wu struct page *kasan_addr_to_page(const void *addr) 120db429f16SAndrey Konovalov { 121db429f16SAndrey Konovalov if ((addr >= (void *)PAGE_OFFSET) && 122db429f16SAndrey Konovalov (addr < high_memory)) 123db429f16SAndrey Konovalov return virt_to_head_page(addr); 124db429f16SAndrey Konovalov return NULL; 125db429f16SAndrey Konovalov } 126db429f16SAndrey Konovalov 1270c06f1f8SAndrey Konovalov static void describe_object_addr(struct kmem_cache *cache, void *object, 1280c06f1f8SAndrey Konovalov const void *addr) 1290c06f1f8SAndrey Konovalov { 1300c06f1f8SAndrey Konovalov unsigned long access_addr = (unsigned long)addr; 1310c06f1f8SAndrey Konovalov unsigned long object_addr = (unsigned long)object; 1320c06f1f8SAndrey Konovalov const char *rel_type; 1330c06f1f8SAndrey Konovalov int rel_bytes; 1340c06f1f8SAndrey Konovalov 1356424f6bbSTobin C. Harding pr_err("The buggy address belongs to the object at %px\n" 1360c06f1f8SAndrey Konovalov " which belongs to the cache %s of size %d\n", 1370c06f1f8SAndrey Konovalov object, cache->name, cache->object_size); 1380c06f1f8SAndrey Konovalov 1390c06f1f8SAndrey Konovalov if (!addr) 1400c06f1f8SAndrey Konovalov return; 1410c06f1f8SAndrey Konovalov 1420c06f1f8SAndrey Konovalov if (access_addr < object_addr) { 1430c06f1f8SAndrey Konovalov rel_type = "to the left"; 1440c06f1f8SAndrey Konovalov rel_bytes = object_addr - access_addr; 1450c06f1f8SAndrey Konovalov } else if (access_addr >= object_addr + cache->object_size) { 1460c06f1f8SAndrey Konovalov rel_type = "to the right"; 1470c06f1f8SAndrey Konovalov rel_bytes = access_addr - (object_addr + cache->object_size); 1480c06f1f8SAndrey Konovalov } else { 1490c06f1f8SAndrey Konovalov rel_type = "inside"; 1500c06f1f8SAndrey Konovalov rel_bytes = access_addr - object_addr; 1510c06f1f8SAndrey Konovalov } 1520c06f1f8SAndrey Konovalov 1530c06f1f8SAndrey Konovalov pr_err("The buggy address is located %d bytes %s of\n" 1546424f6bbSTobin C. Harding " %d-byte region [%px, %px)\n", 1550c06f1f8SAndrey Konovalov rel_bytes, rel_type, cache->object_size, (void *)object_addr, 1560c06f1f8SAndrey Konovalov (void *)(object_addr + cache->object_size)); 1570c06f1f8SAndrey Konovalov } 1580c06f1f8SAndrey Konovalov 1590c06f1f8SAndrey Konovalov static void describe_object(struct kmem_cache *cache, void *object, 160ae8f06b3SWalter Wu const void *addr, u8 tag) 1617ed2f9e6SAlexander Potapenko { 1627ed2f9e6SAlexander Potapenko struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object); 1637ed2f9e6SAlexander Potapenko 1640c06f1f8SAndrey Konovalov if (cache->flags & SLAB_KASAN) { 165ae8f06b3SWalter Wu struct kasan_track *free_track; 166ae8f06b3SWalter Wu 167b6b72f49SAndrey Konovalov print_track(&alloc_info->alloc_track, "Allocated"); 168b1938599SAndrey Konovalov pr_err("\n"); 169ae8f06b3SWalter Wu free_track = kasan_get_free_track(cache, object, tag); 170e4b7818bSWalter Wu if (free_track) { 171ae8f06b3SWalter Wu print_track(free_track, "Freed"); 172b1938599SAndrey Konovalov pr_err("\n"); 173e4b7818bSWalter Wu } 17426e760c9SWalter Wu 17526e760c9SWalter Wu #ifdef CONFIG_KASAN_GENERIC 17626e760c9SWalter Wu if (alloc_info->aux_stack[0]) { 177ef133461SWalter Wu pr_err("Last potentially related work creation:\n"); 17826e760c9SWalter Wu print_stack(alloc_info->aux_stack[0]); 17926e760c9SWalter Wu pr_err("\n"); 18026e760c9SWalter Wu } 18126e760c9SWalter Wu if (alloc_info->aux_stack[1]) { 182ef133461SWalter Wu pr_err("Second to last potentially related work creation:\n"); 18326e760c9SWalter Wu print_stack(alloc_info->aux_stack[1]); 18426e760c9SWalter Wu pr_err("\n"); 18526e760c9SWalter Wu } 18626e760c9SWalter Wu #endif 1877ed2f9e6SAlexander Potapenko } 1887ed2f9e6SAlexander Potapenko 1890c06f1f8SAndrey Konovalov describe_object_addr(cache, object, addr); 1900c06f1f8SAndrey Konovalov } 1910c06f1f8SAndrey Konovalov 19211cd3cd6SAndrey Konovalov static inline bool kernel_or_module_addr(const void *addr) 19311cd3cd6SAndrey Konovalov { 19411cd3cd6SAndrey Konovalov if (addr >= (void *)_stext && addr < (void *)_end) 19511cd3cd6SAndrey Konovalov return true; 19611cd3cd6SAndrey Konovalov if (is_module_address((unsigned long)addr)) 19711cd3cd6SAndrey Konovalov return true; 19811cd3cd6SAndrey Konovalov return false; 19911cd3cd6SAndrey Konovalov } 20011cd3cd6SAndrey Konovalov 20111cd3cd6SAndrey Konovalov static inline bool init_task_stack_addr(const void *addr) 20211cd3cd6SAndrey Konovalov { 20311cd3cd6SAndrey Konovalov return addr >= (void *)&init_thread_union.stack && 20411cd3cd6SAndrey Konovalov (addr <= (void *)&init_thread_union.stack + 20511cd3cd6SAndrey Konovalov sizeof(init_thread_union.stack)); 20611cd3cd6SAndrey Konovalov } 20711cd3cd6SAndrey Konovalov 208ae8f06b3SWalter Wu static void print_address_description(void *addr, u8 tag) 2097e088978SAndrey Ryabinin { 210ae8f06b3SWalter Wu struct page *page = kasan_addr_to_page(addr); 211b8c73fc2SAndrey Ryabinin 212db429f16SAndrey Konovalov dump_stack(); 213b1938599SAndrey Konovalov pr_err("\n"); 214db429f16SAndrey Konovalov 215db429f16SAndrey Konovalov if (page && PageSlab(page)) { 216db429f16SAndrey Konovalov struct kmem_cache *cache = page->slab_cache; 2170c06f1f8SAndrey Konovalov void *object = nearest_obj(cache, page, addr); 218db429f16SAndrey Konovalov 219ae8f06b3SWalter Wu describe_object(cache, object, addr, tag); 220b8c73fc2SAndrey Ryabinin } 221b8c73fc2SAndrey Ryabinin 222430a05f9SAndrey Konovalov if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) { 223430a05f9SAndrey Konovalov pr_err("The buggy address belongs to the variable:\n"); 224430a05f9SAndrey Konovalov pr_err(" %pS\n", addr); 225430a05f9SAndrey Konovalov } 226430a05f9SAndrey Konovalov 227430a05f9SAndrey Konovalov if (page) { 228430a05f9SAndrey Konovalov pr_err("The buggy address belongs to the page:\n"); 229430a05f9SAndrey Konovalov dump_page(page, "kasan: bad access detected"); 230bebf56a1SAndrey Ryabinin } 231e8969219SMarco Elver 232e8969219SMarco Elver print_address_stack_frame(addr); 2330b24beccSAndrey Ryabinin } 2340b24beccSAndrey Ryabinin 235*96e0279dSAndrey Konovalov static bool meta_row_is_guilty(const void *row, const void *addr) 2360b24beccSAndrey Ryabinin { 237*96e0279dSAndrey Konovalov return (row <= addr) && (addr < row + META_MEM_BYTES_PER_ROW); 2380b24beccSAndrey Ryabinin } 2390b24beccSAndrey Ryabinin 240*96e0279dSAndrey Konovalov static int meta_pointer_offset(const void *row, const void *addr) 2410b24beccSAndrey Ryabinin { 242*96e0279dSAndrey Konovalov /* 243*96e0279dSAndrey Konovalov * Memory state around the buggy address: 244*96e0279dSAndrey Konovalov * ff00ff00ff00ff00: 00 00 00 05 fe fe fe fe fe fe fe fe fe fe fe fe 245*96e0279dSAndrey Konovalov * ... 246*96e0279dSAndrey Konovalov * 247*96e0279dSAndrey Konovalov * The length of ">ff00ff00ff00ff00: " is 2480b24beccSAndrey Ryabinin * 3 + (BITS_PER_LONG / 8) * 2 chars. 249*96e0279dSAndrey Konovalov * The length of each granule metadata is 2 bytes 250*96e0279dSAndrey Konovalov * plus 1 byte for space. 2510b24beccSAndrey Ryabinin */ 252*96e0279dSAndrey Konovalov return 3 + (BITS_PER_LONG / 8) * 2 + 253*96e0279dSAndrey Konovalov (addr - row) / KASAN_GRANULE_SIZE * 3 + 1; 2540b24beccSAndrey Ryabinin } 2550b24beccSAndrey Ryabinin 256db3de8f7SAndrey Konovalov static void print_memory_metadata(const void *addr) 2570b24beccSAndrey Ryabinin { 2580b24beccSAndrey Ryabinin int i; 259*96e0279dSAndrey Konovalov void *row; 2600b24beccSAndrey Ryabinin 261*96e0279dSAndrey Konovalov row = (void *)round_down((unsigned long)addr, META_MEM_BYTES_PER_ROW) 262*96e0279dSAndrey Konovalov - META_ROWS_AROUND_ADDR * META_MEM_BYTES_PER_ROW; 2630b24beccSAndrey Ryabinin 2640b24beccSAndrey Ryabinin pr_err("Memory state around the buggy address:\n"); 2650b24beccSAndrey Ryabinin 26688b86597SAndrey Konovalov for (i = -META_ROWS_AROUND_ADDR; i <= META_ROWS_AROUND_ADDR; i++) { 2670b24beccSAndrey Ryabinin char buffer[4 + (BITS_PER_LONG / 8) * 2]; 268*96e0279dSAndrey Konovalov char metadata[META_BYTES_PER_ROW]; 2690b24beccSAndrey Ryabinin 2700b24beccSAndrey Ryabinin snprintf(buffer, sizeof(buffer), 271*96e0279dSAndrey Konovalov (i == 0) ? ">%px: " : " %px: ", row); 272*96e0279dSAndrey Konovalov 273f2377d4eSAneesh Kumar K.V /* 274f2377d4eSAneesh Kumar K.V * We should not pass a shadow pointer to generic 275f2377d4eSAneesh Kumar K.V * function, because generic functions may try to 276f2377d4eSAneesh Kumar K.V * access kasan mapping for the passed address. 277f2377d4eSAneesh Kumar K.V */ 278*96e0279dSAndrey Konovalov metadata_fetch_row(&metadata[0], row); 279*96e0279dSAndrey Konovalov 2800b24beccSAndrey Ryabinin print_hex_dump(KERN_ERR, buffer, 28188b86597SAndrey Konovalov DUMP_PREFIX_NONE, META_BYTES_PER_ROW, 1, 282*96e0279dSAndrey Konovalov metadata, META_BYTES_PER_ROW, 0); 2830b24beccSAndrey Ryabinin 284*96e0279dSAndrey Konovalov if (meta_row_is_guilty(row, addr)) 285*96e0279dSAndrey Konovalov pr_err("%*c\n", meta_pointer_offset(row, addr), '^'); 2860b24beccSAndrey Ryabinin 287*96e0279dSAndrey Konovalov row += META_MEM_BYTES_PER_ROW; 2880b24beccSAndrey Ryabinin } 2890b24beccSAndrey Ryabinin } 2900b24beccSAndrey Ryabinin 2914fba3758SAndrey Konovalov static bool report_enabled(void) 292b0845ce5SMark Rutland { 293d73b4936SAndrey Konovalov #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) 294b0845ce5SMark Rutland if (current->kasan_depth) 295b0845ce5SMark Rutland return false; 296d73b4936SAndrey Konovalov #endif 297b0845ce5SMark Rutland if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) 298b0845ce5SMark Rutland return true; 299b0845ce5SMark Rutland return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags); 300b0845ce5SMark Rutland } 301b0845ce5SMark Rutland 30283c4e7a0SPatricia Alfonso #if IS_ENABLED(CONFIG_KUNIT) 30383c4e7a0SPatricia Alfonso static void kasan_update_kunit_status(struct kunit *cur_test) 30483c4e7a0SPatricia Alfonso { 30583c4e7a0SPatricia Alfonso struct kunit_resource *resource; 30683c4e7a0SPatricia Alfonso struct kunit_kasan_expectation *kasan_data; 30783c4e7a0SPatricia Alfonso 30883c4e7a0SPatricia Alfonso resource = kunit_find_named_resource(cur_test, "kasan_data"); 30983c4e7a0SPatricia Alfonso 31083c4e7a0SPatricia Alfonso if (!resource) { 31183c4e7a0SPatricia Alfonso kunit_set_failure(cur_test); 31283c4e7a0SPatricia Alfonso return; 31383c4e7a0SPatricia Alfonso } 31483c4e7a0SPatricia Alfonso 31583c4e7a0SPatricia Alfonso kasan_data = (struct kunit_kasan_expectation *)resource->data; 31683c4e7a0SPatricia Alfonso kasan_data->report_found = true; 31783c4e7a0SPatricia Alfonso kunit_put_resource(resource); 31883c4e7a0SPatricia Alfonso } 31983c4e7a0SPatricia Alfonso #endif /* IS_ENABLED(CONFIG_KUNIT) */ 32083c4e7a0SPatricia Alfonso 32111cd3cd6SAndrey Konovalov void kasan_report_invalid_free(void *object, unsigned long ip) 32211cd3cd6SAndrey Konovalov { 32311cd3cd6SAndrey Konovalov unsigned long flags; 324ae8f06b3SWalter Wu u8 tag = get_tag(object); 32511cd3cd6SAndrey Konovalov 326ae8f06b3SWalter Wu object = reset_tag(object); 32783c4e7a0SPatricia Alfonso 32883c4e7a0SPatricia Alfonso #if IS_ENABLED(CONFIG_KUNIT) 32983c4e7a0SPatricia Alfonso if (current->kunit_test) 33083c4e7a0SPatricia Alfonso kasan_update_kunit_status(current->kunit_test); 33183c4e7a0SPatricia Alfonso #endif /* IS_ENABLED(CONFIG_KUNIT) */ 33283c4e7a0SPatricia Alfonso 33311cd3cd6SAndrey Konovalov start_report(&flags); 33411cd3cd6SAndrey Konovalov pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip); 335ae8f06b3SWalter Wu print_tags(tag, object); 33611cd3cd6SAndrey Konovalov pr_err("\n"); 337ae8f06b3SWalter Wu print_address_description(object, tag); 33811cd3cd6SAndrey Konovalov pr_err("\n"); 339db3de8f7SAndrey Konovalov print_memory_metadata(object); 34011cd3cd6SAndrey Konovalov end_report(&flags); 34111cd3cd6SAndrey Konovalov } 34211cd3cd6SAndrey Konovalov 3434fba3758SAndrey Konovalov static void __kasan_report(unsigned long addr, size_t size, bool is_write, 3444fba3758SAndrey Konovalov unsigned long ip) 3450b24beccSAndrey Ryabinin { 3460b24beccSAndrey Ryabinin struct kasan_access_info info; 347121e8f81SAndrey Konovalov void *tagged_addr; 348121e8f81SAndrey Konovalov void *untagged_addr; 349121e8f81SAndrey Konovalov unsigned long flags; 3500b24beccSAndrey Ryabinin 35183c4e7a0SPatricia Alfonso #if IS_ENABLED(CONFIG_KUNIT) 35283c4e7a0SPatricia Alfonso if (current->kunit_test) 35383c4e7a0SPatricia Alfonso kasan_update_kunit_status(current->kunit_test); 35483c4e7a0SPatricia Alfonso #endif /* IS_ENABLED(CONFIG_KUNIT) */ 35583c4e7a0SPatricia Alfonso 3564f40c6e5SPeter Zijlstra disable_trace_on_warning(); 3574f40c6e5SPeter Zijlstra 358121e8f81SAndrey Konovalov tagged_addr = (void *)addr; 359121e8f81SAndrey Konovalov untagged_addr = reset_tag(tagged_addr); 360121e8f81SAndrey Konovalov 361121e8f81SAndrey Konovalov info.access_addr = tagged_addr; 3626882464fSAndrey Konovalov if (addr_has_metadata(untagged_addr)) 363121e8f81SAndrey Konovalov info.first_bad_addr = find_first_bad_addr(tagged_addr, size); 364121e8f81SAndrey Konovalov else 365121e8f81SAndrey Konovalov info.first_bad_addr = untagged_addr; 3660b24beccSAndrey Ryabinin info.access_size = size; 3670b24beccSAndrey Ryabinin info.is_write = is_write; 3680b24beccSAndrey Ryabinin info.ip = ip; 369e9121076SAndrey Konovalov 370121e8f81SAndrey Konovalov start_report(&flags); 371121e8f81SAndrey Konovalov 372121e8f81SAndrey Konovalov print_error_description(&info); 3736882464fSAndrey Konovalov if (addr_has_metadata(untagged_addr)) 374121e8f81SAndrey Konovalov print_tags(get_tag(tagged_addr), info.first_bad_addr); 375121e8f81SAndrey Konovalov pr_err("\n"); 376121e8f81SAndrey Konovalov 3776882464fSAndrey Konovalov if (addr_has_metadata(untagged_addr)) { 378ae8f06b3SWalter Wu print_address_description(untagged_addr, get_tag(tagged_addr)); 379121e8f81SAndrey Konovalov pr_err("\n"); 380db3de8f7SAndrey Konovalov print_memory_metadata(info.first_bad_addr); 381121e8f81SAndrey Konovalov } else { 382121e8f81SAndrey Konovalov dump_stack(); 383121e8f81SAndrey Konovalov } 384121e8f81SAndrey Konovalov 385121e8f81SAndrey Konovalov end_report(&flags); 3860b24beccSAndrey Ryabinin } 3872f004eeaSJann Horn 3884fba3758SAndrey Konovalov bool kasan_report(unsigned long addr, size_t size, bool is_write, 3894fba3758SAndrey Konovalov unsigned long ip) 3904fba3758SAndrey Konovalov { 3914fba3758SAndrey Konovalov unsigned long flags = user_access_save(); 3924fba3758SAndrey Konovalov bool ret = false; 3934fba3758SAndrey Konovalov 3944fba3758SAndrey Konovalov if (likely(report_enabled())) { 3954fba3758SAndrey Konovalov __kasan_report(addr, size, is_write, ip); 3964fba3758SAndrey Konovalov ret = true; 3974fba3758SAndrey Konovalov } 3984fba3758SAndrey Konovalov 3994fba3758SAndrey Konovalov user_access_restore(flags); 4004fba3758SAndrey Konovalov 4014fba3758SAndrey Konovalov return ret; 4024fba3758SAndrey Konovalov } 4034fba3758SAndrey Konovalov 4042f004eeaSJann Horn #ifdef CONFIG_KASAN_INLINE 4052f004eeaSJann Horn /* 4062f004eeaSJann Horn * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high 4072f004eeaSJann Horn * canonical half of the address space) cause out-of-bounds shadow memory reads 4082f004eeaSJann Horn * before the actual access. For addresses in the low canonical half of the 4092f004eeaSJann Horn * address space, as well as most non-canonical addresses, that out-of-bounds 4102f004eeaSJann Horn * shadow memory access lands in the non-canonical part of the address space. 4112f004eeaSJann Horn * Help the user figure out what the original bogus pointer was. 4122f004eeaSJann Horn */ 4132f004eeaSJann Horn void kasan_non_canonical_hook(unsigned long addr) 4142f004eeaSJann Horn { 4152f004eeaSJann Horn unsigned long orig_addr; 4162f004eeaSJann Horn const char *bug_type; 4172f004eeaSJann Horn 4182f004eeaSJann Horn if (addr < KASAN_SHADOW_OFFSET) 4192f004eeaSJann Horn return; 4202f004eeaSJann Horn 4212f004eeaSJann Horn orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT; 4222f004eeaSJann Horn /* 4232f004eeaSJann Horn * For faults near the shadow address for NULL, we can be fairly certain 4242f004eeaSJann Horn * that this is a KASAN shadow memory access. 4252f004eeaSJann Horn * For faults that correspond to shadow for low canonical addresses, we 4262f004eeaSJann Horn * can still be pretty sure - that shadow region is a fairly narrow 4272f004eeaSJann Horn * chunk of the non-canonical address space. 4282f004eeaSJann Horn * But faults that look like shadow for non-canonical addresses are a 4292f004eeaSJann Horn * really large chunk of the address space. In that case, we still 4302f004eeaSJann Horn * print the decoded address, but make it clear that this is not 4312f004eeaSJann Horn * necessarily what's actually going on. 4322f004eeaSJann Horn */ 4332f004eeaSJann Horn if (orig_addr < PAGE_SIZE) 4342f004eeaSJann Horn bug_type = "null-ptr-deref"; 4352f004eeaSJann Horn else if (orig_addr < TASK_SIZE) 4362f004eeaSJann Horn bug_type = "probably user-memory-access"; 4372f004eeaSJann Horn else 4382f004eeaSJann Horn bug_type = "maybe wild-memory-access"; 4392f004eeaSJann Horn pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type, 4401f600626SAndrey Konovalov orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1); 4412f004eeaSJann Horn } 4422f004eeaSJann Horn #endif 443