xref: /openbmc/linux/mm/kasan/report.c (revision d6e0cbb1)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * This file contains common generic and tag-based KASAN error reporting code.
4  *
5  * Copyright (c) 2014 Samsung Electronics Co., Ltd.
6  * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
7  *
8  * Some code borrowed from https://github.com/xairy/kasan-prototype by
9  *        Andrey Konovalov <andreyknvl@gmail.com>
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License version 2 as
13  * published by the Free Software Foundation.
14  *
15  */
16 
17 #include <linux/bitops.h>
18 #include <linux/ftrace.h>
19 #include <linux/init.h>
20 #include <linux/kernel.h>
21 #include <linux/mm.h>
22 #include <linux/printk.h>
23 #include <linux/sched.h>
24 #include <linux/slab.h>
25 #include <linux/stackdepot.h>
26 #include <linux/stacktrace.h>
27 #include <linux/string.h>
28 #include <linux/types.h>
29 #include <linux/kasan.h>
30 #include <linux/module.h>
31 #include <linux/sched/task_stack.h>
32 
33 #include <asm/sections.h>
34 
35 #include "kasan.h"
36 #include "../slab.h"
37 
38 /* Shadow layout customization. */
39 #define SHADOW_BYTES_PER_BLOCK 1
40 #define SHADOW_BLOCKS_PER_ROW 16
41 #define SHADOW_BYTES_PER_ROW (SHADOW_BLOCKS_PER_ROW * SHADOW_BYTES_PER_BLOCK)
42 #define SHADOW_ROWS_AROUND_ADDR 2
43 
44 static unsigned long kasan_flags;
45 
46 #define KASAN_BIT_REPORTED	0
47 #define KASAN_BIT_MULTI_SHOT	1
48 
49 bool kasan_save_enable_multi_shot(void)
50 {
51 	return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
52 }
53 EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
54 
55 void kasan_restore_multi_shot(bool enabled)
56 {
57 	if (!enabled)
58 		clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
59 }
60 EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
61 
62 static int __init kasan_set_multi_shot(char *str)
63 {
64 	set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
65 	return 1;
66 }
67 __setup("kasan_multi_shot", kasan_set_multi_shot);
68 
69 static void print_error_description(struct kasan_access_info *info)
70 {
71 	pr_err("BUG: KASAN: %s in %pS\n",
72 		get_bug_type(info), (void *)info->ip);
73 	pr_err("%s of size %zu at addr %px by task %s/%d\n",
74 		info->is_write ? "Write" : "Read", info->access_size,
75 		info->access_addr, current->comm, task_pid_nr(current));
76 }
77 
78 static DEFINE_SPINLOCK(report_lock);
79 
80 static void start_report(unsigned long *flags)
81 {
82 	/*
83 	 * Make sure we don't end up in loop.
84 	 */
85 	kasan_disable_current();
86 	spin_lock_irqsave(&report_lock, *flags);
87 	pr_err("==================================================================\n");
88 }
89 
90 static void end_report(unsigned long *flags)
91 {
92 	pr_err("==================================================================\n");
93 	add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
94 	spin_unlock_irqrestore(&report_lock, *flags);
95 	if (panic_on_warn)
96 		panic("panic_on_warn set ...\n");
97 	kasan_enable_current();
98 }
99 
100 static void print_track(struct kasan_track *track, const char *prefix)
101 {
102 	pr_err("%s by task %u:\n", prefix, track->pid);
103 	if (track->stack) {
104 		unsigned long *entries;
105 		unsigned int nr_entries;
106 
107 		nr_entries = stack_depot_fetch(track->stack, &entries);
108 		stack_trace_print(entries, nr_entries, 0);
109 	} else {
110 		pr_err("(stack is not available)\n");
111 	}
112 }
113 
114 static struct page *addr_to_page(const void *addr)
115 {
116 	if ((addr >= (void *)PAGE_OFFSET) &&
117 			(addr < high_memory))
118 		return virt_to_head_page(addr);
119 	return NULL;
120 }
121 
122 static void describe_object_addr(struct kmem_cache *cache, void *object,
123 				const void *addr)
124 {
125 	unsigned long access_addr = (unsigned long)addr;
126 	unsigned long object_addr = (unsigned long)object;
127 	const char *rel_type;
128 	int rel_bytes;
129 
130 	pr_err("The buggy address belongs to the object at %px\n"
131 	       " which belongs to the cache %s of size %d\n",
132 		object, cache->name, cache->object_size);
133 
134 	if (!addr)
135 		return;
136 
137 	if (access_addr < object_addr) {
138 		rel_type = "to the left";
139 		rel_bytes = object_addr - access_addr;
140 	} else if (access_addr >= object_addr + cache->object_size) {
141 		rel_type = "to the right";
142 		rel_bytes = access_addr - (object_addr + cache->object_size);
143 	} else {
144 		rel_type = "inside";
145 		rel_bytes = access_addr - object_addr;
146 	}
147 
148 	pr_err("The buggy address is located %d bytes %s of\n"
149 	       " %d-byte region [%px, %px)\n",
150 		rel_bytes, rel_type, cache->object_size, (void *)object_addr,
151 		(void *)(object_addr + cache->object_size));
152 }
153 
154 static void describe_object(struct kmem_cache *cache, void *object,
155 				const void *addr)
156 {
157 	struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
158 
159 	if (cache->flags & SLAB_KASAN) {
160 		print_track(&alloc_info->alloc_track, "Allocated");
161 		pr_err("\n");
162 		print_track(&alloc_info->free_track, "Freed");
163 		pr_err("\n");
164 	}
165 
166 	describe_object_addr(cache, object, addr);
167 }
168 
169 static inline bool kernel_or_module_addr(const void *addr)
170 {
171 	if (addr >= (void *)_stext && addr < (void *)_end)
172 		return true;
173 	if (is_module_address((unsigned long)addr))
174 		return true;
175 	return false;
176 }
177 
178 static inline bool init_task_stack_addr(const void *addr)
179 {
180 	return addr >= (void *)&init_thread_union.stack &&
181 		(addr <= (void *)&init_thread_union.stack +
182 			sizeof(init_thread_union.stack));
183 }
184 
185 static bool __must_check tokenize_frame_descr(const char **frame_descr,
186 					      char *token, size_t max_tok_len,
187 					      unsigned long *value)
188 {
189 	const char *sep = strchr(*frame_descr, ' ');
190 
191 	if (sep == NULL)
192 		sep = *frame_descr + strlen(*frame_descr);
193 
194 	if (token != NULL) {
195 		const size_t tok_len = sep - *frame_descr;
196 
197 		if (tok_len + 1 > max_tok_len) {
198 			pr_err("KASAN internal error: frame description too long: %s\n",
199 			       *frame_descr);
200 			return false;
201 		}
202 
203 		/* Copy token (+ 1 byte for '\0'). */
204 		strlcpy(token, *frame_descr, tok_len + 1);
205 	}
206 
207 	/* Advance frame_descr past separator. */
208 	*frame_descr = sep + 1;
209 
210 	if (value != NULL && kstrtoul(token, 10, value)) {
211 		pr_err("KASAN internal error: not a valid number: %s\n", token);
212 		return false;
213 	}
214 
215 	return true;
216 }
217 
218 static void print_decoded_frame_descr(const char *frame_descr)
219 {
220 	/*
221 	 * We need to parse the following string:
222 	 *    "n alloc_1 alloc_2 ... alloc_n"
223 	 * where alloc_i looks like
224 	 *    "offset size len name"
225 	 * or "offset size len name:line".
226 	 */
227 
228 	char token[64];
229 	unsigned long num_objects;
230 
231 	if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
232 				  &num_objects))
233 		return;
234 
235 	pr_err("\n");
236 	pr_err("this frame has %lu %s:\n", num_objects,
237 	       num_objects == 1 ? "object" : "objects");
238 
239 	while (num_objects--) {
240 		unsigned long offset;
241 		unsigned long size;
242 
243 		/* access offset */
244 		if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
245 					  &offset))
246 			return;
247 		/* access size */
248 		if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
249 					  &size))
250 			return;
251 		/* name length (unused) */
252 		if (!tokenize_frame_descr(&frame_descr, NULL, 0, NULL))
253 			return;
254 		/* object name */
255 		if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
256 					  NULL))
257 			return;
258 
259 		/* Strip line number; without filename it's not very helpful. */
260 		strreplace(token, ':', '\0');
261 
262 		/* Finally, print object information. */
263 		pr_err(" [%lu, %lu) '%s'", offset, offset + size, token);
264 	}
265 }
266 
267 static bool __must_check get_address_stack_frame_info(const void *addr,
268 						      unsigned long *offset,
269 						      const char **frame_descr,
270 						      const void **frame_pc)
271 {
272 	unsigned long aligned_addr;
273 	unsigned long mem_ptr;
274 	const u8 *shadow_bottom;
275 	const u8 *shadow_ptr;
276 	const unsigned long *frame;
277 
278 	BUILD_BUG_ON(IS_ENABLED(CONFIG_STACK_GROWSUP));
279 
280 	/*
281 	 * NOTE: We currently only support printing frame information for
282 	 * accesses to the task's own stack.
283 	 */
284 	if (!object_is_on_stack(addr))
285 		return false;
286 
287 	aligned_addr = round_down((unsigned long)addr, sizeof(long));
288 	mem_ptr = round_down(aligned_addr, KASAN_SHADOW_SCALE_SIZE);
289 	shadow_ptr = kasan_mem_to_shadow((void *)aligned_addr);
290 	shadow_bottom = kasan_mem_to_shadow(end_of_stack(current));
291 
292 	while (shadow_ptr >= shadow_bottom && *shadow_ptr != KASAN_STACK_LEFT) {
293 		shadow_ptr--;
294 		mem_ptr -= KASAN_SHADOW_SCALE_SIZE;
295 	}
296 
297 	while (shadow_ptr >= shadow_bottom && *shadow_ptr == KASAN_STACK_LEFT) {
298 		shadow_ptr--;
299 		mem_ptr -= KASAN_SHADOW_SCALE_SIZE;
300 	}
301 
302 	if (shadow_ptr < shadow_bottom)
303 		return false;
304 
305 	frame = (const unsigned long *)(mem_ptr + KASAN_SHADOW_SCALE_SIZE);
306 	if (frame[0] != KASAN_CURRENT_STACK_FRAME_MAGIC) {
307 		pr_err("KASAN internal error: frame info validation failed; invalid marker: %lu\n",
308 		       frame[0]);
309 		return false;
310 	}
311 
312 	*offset = (unsigned long)addr - (unsigned long)frame;
313 	*frame_descr = (const char *)frame[1];
314 	*frame_pc = (void *)frame[2];
315 
316 	return true;
317 }
318 
319 static void print_address_stack_frame(const void *addr)
320 {
321 	unsigned long offset;
322 	const char *frame_descr;
323 	const void *frame_pc;
324 
325 	if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
326 		return;
327 
328 	if (!get_address_stack_frame_info(addr, &offset, &frame_descr,
329 					  &frame_pc))
330 		return;
331 
332 	/*
333 	 * get_address_stack_frame_info only returns true if the given addr is
334 	 * on the current task's stack.
335 	 */
336 	pr_err("\n");
337 	pr_err("addr %px is located in stack of task %s/%d at offset %lu in frame:\n",
338 	       addr, current->comm, task_pid_nr(current), offset);
339 	pr_err(" %pS\n", frame_pc);
340 
341 	if (!frame_descr)
342 		return;
343 
344 	print_decoded_frame_descr(frame_descr);
345 }
346 
347 static void print_address_description(void *addr)
348 {
349 	struct page *page = addr_to_page(addr);
350 
351 	dump_stack();
352 	pr_err("\n");
353 
354 	if (page && PageSlab(page)) {
355 		struct kmem_cache *cache = page->slab_cache;
356 		void *object = nearest_obj(cache, page,	addr);
357 
358 		describe_object(cache, object, addr);
359 	}
360 
361 	if (kernel_or_module_addr(addr) && !init_task_stack_addr(addr)) {
362 		pr_err("The buggy address belongs to the variable:\n");
363 		pr_err(" %pS\n", addr);
364 	}
365 
366 	if (page) {
367 		pr_err("The buggy address belongs to the page:\n");
368 		dump_page(page, "kasan: bad access detected");
369 	}
370 
371 	print_address_stack_frame(addr);
372 }
373 
374 static bool row_is_guilty(const void *row, const void *guilty)
375 {
376 	return (row <= guilty) && (guilty < row + SHADOW_BYTES_PER_ROW);
377 }
378 
379 static int shadow_pointer_offset(const void *row, const void *shadow)
380 {
381 	/* The length of ">ff00ff00ff00ff00: " is
382 	 *    3 + (BITS_PER_LONG/8)*2 chars.
383 	 */
384 	return 3 + (BITS_PER_LONG/8)*2 + (shadow - row)*2 +
385 		(shadow - row) / SHADOW_BYTES_PER_BLOCK + 1;
386 }
387 
388 static void print_shadow_for_address(const void *addr)
389 {
390 	int i;
391 	const void *shadow = kasan_mem_to_shadow(addr);
392 	const void *shadow_row;
393 
394 	shadow_row = (void *)round_down((unsigned long)shadow,
395 					SHADOW_BYTES_PER_ROW)
396 		- SHADOW_ROWS_AROUND_ADDR * SHADOW_BYTES_PER_ROW;
397 
398 	pr_err("Memory state around the buggy address:\n");
399 
400 	for (i = -SHADOW_ROWS_AROUND_ADDR; i <= SHADOW_ROWS_AROUND_ADDR; i++) {
401 		const void *kaddr = kasan_shadow_to_mem(shadow_row);
402 		char buffer[4 + (BITS_PER_LONG/8)*2];
403 		char shadow_buf[SHADOW_BYTES_PER_ROW];
404 
405 		snprintf(buffer, sizeof(buffer),
406 			(i == 0) ? ">%px: " : " %px: ", kaddr);
407 		/*
408 		 * We should not pass a shadow pointer to generic
409 		 * function, because generic functions may try to
410 		 * access kasan mapping for the passed address.
411 		 */
412 		memcpy(shadow_buf, shadow_row, SHADOW_BYTES_PER_ROW);
413 		print_hex_dump(KERN_ERR, buffer,
414 			DUMP_PREFIX_NONE, SHADOW_BYTES_PER_ROW, 1,
415 			shadow_buf, SHADOW_BYTES_PER_ROW, 0);
416 
417 		if (row_is_guilty(shadow_row, shadow))
418 			pr_err("%*c\n",
419 				shadow_pointer_offset(shadow_row, shadow),
420 				'^');
421 
422 		shadow_row += SHADOW_BYTES_PER_ROW;
423 	}
424 }
425 
426 static bool report_enabled(void)
427 {
428 	if (current->kasan_depth)
429 		return false;
430 	if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
431 		return true;
432 	return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
433 }
434 
435 void kasan_report_invalid_free(void *object, unsigned long ip)
436 {
437 	unsigned long flags;
438 
439 	start_report(&flags);
440 	pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
441 	print_tags(get_tag(object), reset_tag(object));
442 	object = reset_tag(object);
443 	pr_err("\n");
444 	print_address_description(object);
445 	pr_err("\n");
446 	print_shadow_for_address(object);
447 	end_report(&flags);
448 }
449 
450 void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip)
451 {
452 	struct kasan_access_info info;
453 	void *tagged_addr;
454 	void *untagged_addr;
455 	unsigned long flags;
456 
457 	if (likely(!report_enabled()))
458 		return;
459 
460 	disable_trace_on_warning();
461 
462 	tagged_addr = (void *)addr;
463 	untagged_addr = reset_tag(tagged_addr);
464 
465 	info.access_addr = tagged_addr;
466 	if (addr_has_shadow(untagged_addr))
467 		info.first_bad_addr = find_first_bad_addr(tagged_addr, size);
468 	else
469 		info.first_bad_addr = untagged_addr;
470 	info.access_size = size;
471 	info.is_write = is_write;
472 	info.ip = ip;
473 
474 	start_report(&flags);
475 
476 	print_error_description(&info);
477 	if (addr_has_shadow(untagged_addr))
478 		print_tags(get_tag(tagged_addr), info.first_bad_addr);
479 	pr_err("\n");
480 
481 	if (addr_has_shadow(untagged_addr)) {
482 		print_address_description(untagged_addr);
483 		pr_err("\n");
484 		print_shadow_for_address(info.first_bad_addr);
485 	} else {
486 		dump_stack();
487 	}
488 
489 	end_report(&flags);
490 }
491