Commit 59e6e098 authored by Andrey Konovalov's avatar Andrey Konovalov Committed by Andrew Morton
Browse files

kasan: introduce kasan_complete_mode_report_info 

Add bug_type and alloc/free_track fields to kasan_report_info and add a
kasan_complete_mode_report_info() function that fills in these fields. 
This function is implemented differently for different KASAN mode.

Change the reporting code to use the filled in fields instead of invoking
kasan_get_bug_type() and kasan_get_alloc/free_track().

For the Generic mode, kasan_complete_mode_report_info() invokes these
functions instead.  For the tag-based modes, only the bug_type field is
filled in; alloc/free_track are handled in the next patch.

Using a single function that fills in these fields is required for the
tag-based modes, as the values for all three fields are determined in a
single procedure implemented in the following patch.

Link: https://lkml.kernel.org/r/8432b861054fa8d0cee79a8877dedeaf3b677ca8.1662411799.git.andreyknvl@google.com


Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Reviewed-by: default avatarMarco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 92a38eac

mm/kasan/kasan.h

+17 −16
Original line number Diff line number Diff line
@@ -146,6 +146,13 @@ static inline bool kasan_requires_meta(void) 
#define META_MEM_BYTES_PER_ROW (META_BYTES_PER_ROW * KASAN_GRANULE_SIZE)

#define META_ROWS_AROUND_ADDR 2



#define KASAN_STACK_DEPTH 64



struct kasan_track {

	u32 pid;

	depot_stack_handle_t stack;

};



enum kasan_report_type {

	KASAN_REPORT_ACCESS,

	KASAN_REPORT_INVALID_FREE,
@@ -164,6 +171,11 @@ struct kasan_report_info { 
	void *first_bad_addr;

	struct kmem_cache *cache;

	void *object;



	/* Filled in by the mode-specific reporting code. */

	const char *bug_type;

	struct kasan_track alloc_track;

	struct kasan_track free_track;

};



/* Do not change the struct layout: compiler ABI. */
@@ -189,14 +201,7 @@ struct kasan_global { 
#endif

};



/* Structures for keeping alloc and free tracks. */



#define KASAN_STACK_DEPTH 64



struct kasan_track {

	u32 pid;

	depot_stack_handle_t stack;

};

/* Structures for keeping alloc and free meta. */



#ifdef CONFIG_KASAN_GENERIC
@@ -270,16 +275,16 @@ static inline bool addr_has_metadata(const void *addr) 


#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */



void *kasan_find_first_bad_addr(void *addr, size_t size);

void kasan_complete_mode_report_info(struct kasan_report_info *info);

void kasan_metadata_fetch_row(char *buffer, void *row);



#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)

void kasan_print_tags(u8 addr_tag, const void *addr);

#else

static inline void kasan_print_tags(u8 addr_tag, const void *addr) { }

#endif



void *kasan_find_first_bad_addr(void *addr, size_t size);

const char *kasan_get_bug_type(struct kasan_report_info *info);

void kasan_metadata_fetch_row(char *buffer, void *row);



#if defined(CONFIG_KASAN_STACK)

void kasan_print_address_stack_frame(const void *addr);

#else
@@ -314,10 +319,6 @@ depot_stack_handle_t kasan_save_stack(gfp_t flags, bool can_alloc); 
void kasan_set_track(struct kasan_track *track, gfp_t flags);

void kasan_save_alloc_info(struct kmem_cache *cache, void *object, gfp_t flags);

void kasan_save_free_info(struct kmem_cache *cache, void *object);

struct kasan_track *kasan_get_alloc_track(struct kmem_cache *cache,

						void *object);

struct kasan_track *kasan_get_free_track(struct kmem_cache *cache,

						void *object, u8 tag);



#if defined(CONFIG_KASAN_GENERIC) && \

	(defined(CONFIG_SLAB) || defined(CONFIG_SLUB))

mm/kasan/report.c

+14 −16
Original line number Diff line number Diff line
@@ -185,8 +185,7 @@ static void print_error_description(struct kasan_report_info *info) 
		return;

	}



	pr_err("BUG: KASAN: %s in %pS\n",

		kasan_get_bug_type(info), (void *)info->ip);

	pr_err("BUG: KASAN: %s in %pS\n", info->bug_type, (void *)info->ip);

	if (info->access_size)

		pr_err("%s of size %zu at addr %px by task %s/%d\n",

			info->is_write ? "Write" : "Read", info->access_size,
@@ -242,31 +241,25 @@ static void describe_object_addr(const void *addr, struct kmem_cache *cache, 
		(void *)(object_addr + cache->object_size));

}



static void describe_object_stacks(u8 tag, struct kasan_report_info *info)

static void describe_object_stacks(struct kasan_report_info *info)

{

	struct kasan_track *alloc_track;

	struct kasan_track *free_track;



	alloc_track = kasan_get_alloc_track(info->cache, info->object);

	if (alloc_track) {

		print_track(alloc_track, "Allocated");

	if (info->alloc_track.stack) {

		print_track(&info->alloc_track, "Allocated");

		pr_err("\n");

	}



	free_track = kasan_get_free_track(info->cache, info->object, tag);

	if (free_track) {

		print_track(free_track, "Freed");

	if (info->free_track.stack) {

		print_track(&info->free_track, "Freed");

		pr_err("\n");

	}



	kasan_print_aux_stacks(info->cache, info->object);

}



static void describe_object(const void *addr, u8 tag,

			    struct kasan_report_info *info)

static void describe_object(const void *addr, struct kasan_report_info *info)

{

	if (kasan_stack_collection_enabled())

		describe_object_stacks(tag, info);

		describe_object_stacks(info);

	describe_object_addr(addr, info->cache, info->object);

}
@@ -295,7 +288,7 @@ static void print_address_description(void *addr, u8 tag, 
	pr_err("\n");



	if (info->cache && info->object) {

		describe_object(addr, tag, info);

		describe_object(addr, info);

		pr_err("\n");

	}
@@ -426,6 +419,9 @@ static void complete_report_info(struct kasan_report_info *info) 
		info->object = nearest_obj(info->cache, slab, addr);

	} else

		info->cache = info->object = NULL;



	/* Fill in mode-specific report info fields. */

	kasan_complete_mode_report_info(info);

}



void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_type type)
@@ -443,6 +439,7 @@ void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_ty 


	start_report(&flags, true);



	memset(&info, 0, sizeof(info));

	info.type = type;

	info.access_addr = ptr;

	info.access_size = 0;
@@ -477,6 +474,7 @@ bool kasan_report(unsigned long addr, size_t size, bool is_write, 


	start_report(&irq_flags, true);



	memset(&info, 0, sizeof(info));

	info.type = KASAN_REPORT_ACCESS;

	info.access_addr = ptr;

	info.access_size = size;

mm/kasan/report_generic.c

+17 −15
Original line number Diff line number Diff line
@@ -109,7 +109,7 @@ static const char *get_wild_bug_type(struct kasan_report_info *info) 
	return bug_type;

}



const char *kasan_get_bug_type(struct kasan_report_info *info)

static const char *get_bug_type(struct kasan_report_info *info)

{

	/*

	 * If access_size is a negative number, then it has reason to be
@@ -127,25 +127,27 @@ const char *kasan_get_bug_type(struct kasan_report_info *info) 
	return get_wild_bug_type(info);

}



struct kasan_track *kasan_get_alloc_track(struct kmem_cache *cache,

						void *object)

void kasan_complete_mode_report_info(struct kasan_report_info *info)

{

	struct kasan_alloc_meta *alloc_meta;

	struct kasan_free_meta *free_meta;



	alloc_meta = kasan_get_alloc_meta(cache, object);

	if (!alloc_meta)

		return NULL;

	info->bug_type = get_bug_type(info);



	return &alloc_meta->alloc_track;

}

	if (!info->cache || !info->object)

		return;



struct kasan_track *kasan_get_free_track(struct kmem_cache *cache,

						void *object, u8 tag)

{

	if (*(u8 *)kasan_mem_to_shadow(object) != KASAN_SLAB_FREETRACK)

		return NULL;

	alloc_meta = kasan_get_alloc_meta(info->cache, info->object);

	if (alloc_meta)

		memcpy(&info->alloc_track, &alloc_meta->alloc_track,

		       sizeof(info->alloc_track));



	if (*(u8 *)kasan_mem_to_shadow(info->object) == KASAN_SLAB_FREETRACK) {

		/* Free meta must be present with KASAN_SLAB_FREETRACK. */

	return &kasan_get_free_meta(cache, object)->free_track;

		free_meta = kasan_get_free_meta(info->cache, info->object);

		memcpy(&info->free_track, &free_meta->free_track,

		       sizeof(info->free_track));

	}

}



void kasan_metadata_fetch_row(char *buffer, void *row)

mm/kasan/report_tags.c

+3 −10
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 


#include "kasan.h"



const char *kasan_get_bug_type(struct kasan_report_info *info)

static const char *get_bug_type(struct kasan_report_info *info)

{

	/*

	 * If access_size is a negative number, then it has reason to be
@@ -22,14 +22,7 @@ const char *kasan_get_bug_type(struct kasan_report_info *info) 
	return "invalid-access";

}



struct kasan_track *kasan_get_alloc_track(struct kmem_cache *cache,

						void *object)

void kasan_complete_mode_report_info(struct kasan_report_info *info)

{

	return NULL;

}



struct kasan_track *kasan_get_free_track(struct kmem_cache *cache,

						void *object, u8 tag)

{

	return NULL;

	info->bug_type = get_bug_type(info);

}