lkml.org 
[lkml]   [2018]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v13 17/25] kasan: add bug reporting routines for tag-based mode
    Date
    This commit adds rountines, that print tag-based KASAN error reports.
    Those are quite similar to generic KASAN, the difference is:

    1. The way tag-based KASAN finds the first bad shadow cell (with a
    mismatching tag). Tag-based KASAN compares memory tags from the shadow
    memory to the pointer tag.

    2. Tag-based KASAN reports all bugs with the "KASAN: invalid-access"
    header.

    Also simplify generic KASAN find_first_bad_addr.

    Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
    Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
    ---
    mm/kasan/generic_report.c | 16 ++++-------
    mm/kasan/kasan.h | 5 ++++
    mm/kasan/report.c | 57 +++++++++++++++++++++------------------
    mm/kasan/tags_report.c | 18 +++++++++++++
    4 files changed, 59 insertions(+), 37 deletions(-)

    diff --git a/mm/kasan/generic_report.c b/mm/kasan/generic_report.c
    index 5201d1770700..a4604cceae59 100644
    --- a/mm/kasan/generic_report.c
    +++ b/mm/kasan/generic_report.c
    @@ -33,16 +33,13 @@
    #include "kasan.h"
    #include "../slab.h"

    -static const void *find_first_bad_addr(const void *addr, size_t size)
    +void *find_first_bad_addr(void *addr, size_t size)
    {
    - u8 shadow_val = *(u8 *)kasan_mem_to_shadow(addr);
    - const void *first_bad_addr = addr;
    + void *p = addr;

    - while (!shadow_val && first_bad_addr < addr + size) {
    - first_bad_addr += KASAN_SHADOW_SCALE_SIZE;
    - shadow_val = *(u8 *)kasan_mem_to_shadow(first_bad_addr);
    - }
    - return first_bad_addr;
    + while (p < addr + size && !(*(u8 *)kasan_mem_to_shadow(p)))
    + p += KASAN_SHADOW_SCALE_SIZE;
    + return p;
    }

    static const char *get_shadow_bug_type(struct kasan_access_info *info)
    @@ -50,9 +47,6 @@ static const char *get_shadow_bug_type(struct kasan_access_info *info)
    const char *bug_type = "unknown-crash";
    u8 *shadow_addr;

    - info->first_bad_addr = find_first_bad_addr(info->access_addr,
    - info->access_size);
    -
    shadow_addr = (u8 *)kasan_mem_to_shadow(info->first_bad_addr);

    /*
    diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
    index 33cc3b0e017e..82a23b23ff93 100644
    --- a/mm/kasan/kasan.h
    +++ b/mm/kasan/kasan.h
    @@ -119,6 +119,7 @@ void kasan_poison_shadow(const void *address, size_t size, u8 value);
    void check_memory_region(unsigned long addr, size_t size, bool write,
    unsigned long ret_ip);

    +void *find_first_bad_addr(void *addr, size_t size);
    const char *get_bug_type(struct kasan_access_info *info);

    void kasan_report(unsigned long addr, size_t size,
    @@ -139,10 +140,14 @@ static inline void quarantine_remove_cache(struct kmem_cache *cache) { }

    #ifdef CONFIG_KASAN_SW_TAGS

    +void print_tags(u8 addr_tag, const void *addr);
    +
    u8 random_tag(void);

    #else

    +static inline void print_tags(u8 addr_tag, const void *addr) { }
    +
    static inline u8 random_tag(void)
    {
    return 0;
    diff --git a/mm/kasan/report.c b/mm/kasan/report.c
    index 64a74f334c45..214d85035f99 100644
    --- a/mm/kasan/report.c
    +++ b/mm/kasan/report.c
    @@ -64,11 +64,10 @@ static int __init kasan_set_multi_shot(char *str)
    }
    __setup("kasan_multi_shot", kasan_set_multi_shot);

    -static void print_error_description(struct kasan_access_info *info,
    - const char *bug_type)
    +static void print_error_description(struct kasan_access_info *info)
    {
    pr_err("BUG: KASAN: %s in %pS\n",
    - bug_type, (void *)info->ip);
    + get_bug_type(info), (void *)info->ip);
    pr_err("%s of size %zu at addr %px by task %s/%d\n",
    info->is_write ? "Write" : "Read", info->access_size,
    info->access_addr, current->comm, task_pid_nr(current));
    @@ -272,6 +271,8 @@ void kasan_report_invalid_free(void *object, unsigned long ip)

    start_report(&flags);
    pr_err("BUG: KASAN: double-free or invalid-free in %pS\n", (void *)ip);
    + print_tags(get_tag(object), reset_tag(object));
    + object = reset_tag(object);
    pr_err("\n");
    print_address_description(object);
    pr_err("\n");
    @@ -279,41 +280,45 @@ void kasan_report_invalid_free(void *object, unsigned long ip)
    end_report(&flags);
    }

    -static void kasan_report_error(struct kasan_access_info *info)
    -{
    - unsigned long flags;
    -
    - start_report(&flags);
    -
    - print_error_description(info, get_bug_type(info));
    - pr_err("\n");
    -
    - if (!addr_has_shadow(info->access_addr)) {
    - dump_stack();
    - } else {
    - print_address_description((void *)info->access_addr);
    - pr_err("\n");
    - print_shadow_for_address(info->first_bad_addr);
    - }
    -
    - end_report(&flags);
    -}
    -
    void kasan_report(unsigned long addr, size_t size,
    bool is_write, unsigned long ip)
    {
    struct kasan_access_info info;
    + void *tagged_addr;
    + void *untagged_addr;
    + unsigned long flags;

    if (likely(!report_enabled()))
    return;

    disable_trace_on_warning();

    - info.access_addr = (void *)addr;
    - info.first_bad_addr = (void *)addr;
    + tagged_addr = (void *)addr;
    + untagged_addr = reset_tag(tagged_addr);
    +
    + info.access_addr = tagged_addr;
    + if (addr_has_shadow(untagged_addr))
    + info.first_bad_addr = find_first_bad_addr(tagged_addr, size);
    + else
    + info.first_bad_addr = untagged_addr;
    info.access_size = size;
    info.is_write = is_write;
    info.ip = ip;

    - kasan_report_error(&info);
    + start_report(&flags);
    +
    + print_error_description(&info);
    + if (addr_has_shadow(untagged_addr))
    + print_tags(get_tag(tagged_addr), info.first_bad_addr);
    + pr_err("\n");
    +
    + if (addr_has_shadow(untagged_addr)) {
    + print_address_description(untagged_addr);
    + pr_err("\n");
    + print_shadow_for_address(info.first_bad_addr);
    + } else {
    + dump_stack();
    + }
    +
    + end_report(&flags);
    }
    diff --git a/mm/kasan/tags_report.c b/mm/kasan/tags_report.c
    index 8af15e87d3bc..573c51d20d09 100644
    --- a/mm/kasan/tags_report.c
    +++ b/mm/kasan/tags_report.c
    @@ -37,3 +37,21 @@ const char *get_bug_type(struct kasan_access_info *info)
    {
    return "invalid-access";
    }
    +
    +void *find_first_bad_addr(void *addr, size_t size)
    +{
    + u8 tag = get_tag(addr);
    + void *p = reset_tag(addr);
    + void *end = p + size;
    +
    + while (p < end && tag == *(u8 *)kasan_mem_to_shadow(p))
    + p += KASAN_SHADOW_SCALE_SIZE;
    + return p;
    +}
    +
    +void print_tags(u8 addr_tag, const void *addr)
    +{
    + u8 *shadow = (u8 *)kasan_mem_to_shadow(addr);
    +
    + pr_err("Pointer tag: [%02x], memory tag: [%02x]\n", addr_tag, *shadow);
    +}
    --
    2.20.0.rc1.387.gf8505762e3-goog
    \
     
     \ /
      Last update: 2018-12-06 13:27    [W:5.687 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site