kfence.h 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. /*
  3. * Kernel Electric-Fence (KFENCE). For more info please see
  4. * Documentation/dev-tools/kfence.rst.
  5. *
  6. * Copyright (C) 2020, Google LLC.
  7. */
  8. #ifndef MM_KFENCE_KFENCE_H
  9. #define MM_KFENCE_KFENCE_H
  10. #include <linux/mm.h>
  11. #include <linux/slab.h>
  12. #include <linux/spinlock.h>
  13. #include <linux/types.h>
  14. #include "../slab.h" /* for struct kmem_cache */
  15. /*
  16. * Get the canary byte pattern for @addr. Use a pattern that varies based on the
  17. * lower 3 bits of the address, to detect memory corruptions with higher
  18. * probability, where similar constants are used.
  19. */
  20. #define KFENCE_CANARY_PATTERN(addr) ((u8)0xaa ^ (u8)((unsigned long)(addr) & 0x7))
  21. /* Maximum stack depth for reports. */
  22. #define KFENCE_STACK_DEPTH 64
  23. /* KFENCE object states. */
  24. enum kfence_object_state {
  25. KFENCE_OBJECT_UNUSED, /* Object is unused. */
  26. KFENCE_OBJECT_ALLOCATED, /* Object is currently allocated. */
  27. KFENCE_OBJECT_FREED, /* Object was allocated, and then freed. */
  28. };
  29. /* Alloc/free tracking information. */
  30. struct kfence_track {
  31. pid_t pid;
  32. int num_stack_entries;
  33. unsigned long stack_entries[KFENCE_STACK_DEPTH];
  34. };
  35. /* KFENCE metadata per guarded allocation. */
  36. struct kfence_metadata {
  37. struct list_head list; /* Freelist node; access under kfence_freelist_lock. */
  38. struct rcu_head rcu_head; /* For delayed freeing. */
  39. /*
  40. * Lock protecting below data; to ensure consistency of the below data,
  41. * since the following may execute concurrently: __kfence_alloc(),
  42. * __kfence_free(), kfence_handle_page_fault(). However, note that we
  43. * cannot grab the same metadata off the freelist twice, and multiple
  44. * __kfence_alloc() cannot run concurrently on the same metadata.
  45. */
  46. raw_spinlock_t lock;
  47. /* The current state of the object; see above. */
  48. enum kfence_object_state state;
  49. /*
  50. * Allocated object address; cannot be calculated from size, because of
  51. * alignment requirements.
  52. *
  53. * Invariant: ALIGN_DOWN(addr, PAGE_SIZE) is constant.
  54. */
  55. unsigned long addr;
  56. /*
  57. * The size of the original allocation.
  58. */
  59. size_t size;
  60. /*
  61. * The kmem_cache cache of the last allocation; NULL if never allocated
  62. * or the cache has already been destroyed.
  63. */
  64. struct kmem_cache *cache;
  65. /*
  66. * In case of an invalid access, the page that was unprotected; we
  67. * optimistically only store one address.
  68. */
  69. unsigned long unprotected_page;
  70. /* Allocation and free stack information. */
  71. struct kfence_track alloc_track;
  72. struct kfence_track free_track;
  73. };
  74. extern struct kfence_metadata kfence_metadata[CONFIG_KFENCE_NUM_OBJECTS];
  75. /* KFENCE error types for report generation. */
  76. enum kfence_error_type {
  77. KFENCE_ERROR_OOB, /* Detected a out-of-bounds access. */
  78. KFENCE_ERROR_UAF, /* Detected a use-after-free access. */
  79. KFENCE_ERROR_CORRUPTION, /* Detected a memory corruption on free. */
  80. KFENCE_ERROR_INVALID, /* Invalid access of unknown type. */
  81. KFENCE_ERROR_INVALID_FREE, /* Invalid free. */
  82. };
  83. void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *regs,
  84. const struct kfence_metadata *meta, enum kfence_error_type type);
  85. void kfence_print_object(struct seq_file *seq, const struct kfence_metadata *meta);
  86. #endif /* MM_KFENCE_KFENCE_H */