report.c 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * KFENCE reporting.
  4. *
  5. * Copyright (C) 2020, Google LLC.
  6. */
  7. #include <stdarg.h>
  8. #include <linux/kernel.h>
  9. #include <linux/lockdep.h>
  10. #include <linux/printk.h>
  11. #include <linux/sched/debug.h>
  12. #include <linux/seq_file.h>
  13. #include <linux/stacktrace.h>
  14. #include <linux/string.h>
  15. #include <trace/events/error_report.h>
  16. #include <asm/kfence.h>
  17. #include "kfence.h"
  18. /* May be overridden by <asm/kfence.h>. */
  19. #ifndef ARCH_FUNC_PREFIX
  20. #define ARCH_FUNC_PREFIX ""
  21. #endif
  22. extern bool no_hash_pointers;
  23. /* Helper function to either print to a seq_file or to console. */
  24. __printf(2, 3)
  25. static void seq_con_printf(struct seq_file *seq, const char *fmt, ...)
  26. {
  27. va_list args;
  28. va_start(args, fmt);
  29. if (seq)
  30. seq_vprintf(seq, fmt, args);
  31. else
  32. vprintk(fmt, args);
  33. va_end(args);
  34. }
  35. /*
  36. * Get the number of stack entries to skip to get out of MM internals. @type is
  37. * optional, and if set to NULL, assumes an allocation or free stack.
  38. */
  39. static int get_stack_skipnr(const unsigned long stack_entries[], int num_entries,
  40. const enum kfence_error_type *type)
  41. {
  42. char buf[64];
  43. int skipnr, fallback = 0;
  44. if (type) {
  45. /* Depending on error type, find different stack entries. */
  46. switch (*type) {
  47. case KFENCE_ERROR_UAF:
  48. case KFENCE_ERROR_OOB:
  49. case KFENCE_ERROR_INVALID:
  50. /*
  51. * kfence_handle_page_fault() may be called with pt_regs
  52. * set to NULL; in that case we'll simply show the full
  53. * stack trace.
  54. */
  55. return 0;
  56. case KFENCE_ERROR_CORRUPTION:
  57. case KFENCE_ERROR_INVALID_FREE:
  58. break;
  59. }
  60. }
  61. for (skipnr = 0; skipnr < num_entries; skipnr++) {
  62. int len = scnprintf(buf, sizeof(buf), "%ps", (void *)stack_entries[skipnr]);
  63. if (str_has_prefix(buf, ARCH_FUNC_PREFIX "kfence_") ||
  64. str_has_prefix(buf, ARCH_FUNC_PREFIX "__kfence_") ||
  65. !strncmp(buf, ARCH_FUNC_PREFIX "__slab_free", len)) {
  66. /*
  67. * In case of tail calls from any of the below
  68. * to any of the above.
  69. */
  70. fallback = skipnr + 1;
  71. }
  72. /* Also the *_bulk() variants by only checking prefixes. */
  73. if (str_has_prefix(buf, ARCH_FUNC_PREFIX "kfree") ||
  74. str_has_prefix(buf, ARCH_FUNC_PREFIX "kmem_cache_free") ||
  75. str_has_prefix(buf, ARCH_FUNC_PREFIX "__kmalloc") ||
  76. str_has_prefix(buf, ARCH_FUNC_PREFIX "kmem_cache_alloc"))
  77. goto found;
  78. }
  79. if (fallback < num_entries)
  80. return fallback;
  81. found:
  82. skipnr++;
  83. return skipnr < num_entries ? skipnr : 0;
  84. }
  85. static void kfence_print_stack(struct seq_file *seq, const struct kfence_metadata *meta,
  86. bool show_alloc)
  87. {
  88. const struct kfence_track *track = show_alloc ? &meta->alloc_track : &meta->free_track;
  89. if (track->num_stack_entries) {
  90. /* Skip allocation/free internals stack. */
  91. int i = get_stack_skipnr(track->stack_entries, track->num_stack_entries, NULL);
  92. /* stack_trace_seq_print() does not exist; open code our own. */
  93. for (; i < track->num_stack_entries; i++)
  94. seq_con_printf(seq, " %pS\n", (void *)track->stack_entries[i]);
  95. } else {
  96. seq_con_printf(seq, " no %s stack\n", show_alloc ? "allocation" : "deallocation");
  97. }
  98. }
  99. void kfence_print_object(struct seq_file *seq, const struct kfence_metadata *meta)
  100. {
  101. const int size = abs(meta->size);
  102. const unsigned long start = meta->addr;
  103. const struct kmem_cache *const cache = meta->cache;
  104. lockdep_assert_held(&meta->lock);
  105. if (meta->state == KFENCE_OBJECT_UNUSED) {
  106. seq_con_printf(seq, "kfence-#%td unused\n", meta - kfence_metadata);
  107. return;
  108. }
  109. seq_con_printf(seq,
  110. "kfence-#%td [0x%p-0x%p"
  111. ", size=%d, cache=%s] allocated by task %d:\n",
  112. meta - kfence_metadata, (void *)start, (void *)(start + size - 1), size,
  113. (cache && cache->name) ? cache->name : "<destroyed>", meta->alloc_track.pid);
  114. kfence_print_stack(seq, meta, true);
  115. if (meta->state == KFENCE_OBJECT_FREED) {
  116. seq_con_printf(seq, "\nfreed by task %d:\n", meta->free_track.pid);
  117. kfence_print_stack(seq, meta, false);
  118. }
  119. }
  120. /*
  121. * Show bytes at @addr that are different from the expected canary values, up to
  122. * @max_bytes.
  123. */
  124. static void print_diff_canary(unsigned long address, size_t bytes_to_show,
  125. const struct kfence_metadata *meta)
  126. {
  127. const unsigned long show_until_addr = address + bytes_to_show;
  128. const u8 *cur, *end;
  129. /* Do not show contents of object nor read into following guard page. */
  130. end = (const u8 *)(address < meta->addr ? min(show_until_addr, meta->addr)
  131. : min(show_until_addr, PAGE_ALIGN(address)));
  132. pr_cont("[");
  133. for (cur = (const u8 *)address; cur < end; cur++) {
  134. if (*cur == KFENCE_CANARY_PATTERN(cur))
  135. pr_cont(" .");
  136. else if (no_hash_pointers)
  137. pr_cont(" 0x%02x", *cur);
  138. else /* Do not leak kernel memory in non-debug builds. */
  139. pr_cont(" !");
  140. }
  141. pr_cont(" ]");
  142. }
  143. static const char *get_access_type(bool is_write)
  144. {
  145. return is_write ? "write" : "read";
  146. }
  147. void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *regs,
  148. const struct kfence_metadata *meta, enum kfence_error_type type)
  149. {
  150. unsigned long stack_entries[KFENCE_STACK_DEPTH] = { 0 };
  151. const ptrdiff_t object_index = meta ? meta - kfence_metadata : -1;
  152. int num_stack_entries;
  153. int skipnr = 0;
  154. if (regs) {
  155. num_stack_entries = stack_trace_save_regs(regs, stack_entries, KFENCE_STACK_DEPTH, 0);
  156. } else {
  157. num_stack_entries = stack_trace_save(stack_entries, KFENCE_STACK_DEPTH, 1);
  158. skipnr = get_stack_skipnr(stack_entries, num_stack_entries, &type);
  159. }
  160. /* Require non-NULL meta, except if KFENCE_ERROR_INVALID. */
  161. if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta))
  162. return;
  163. if (meta)
  164. lockdep_assert_held(&meta->lock);
  165. /*
  166. * Because we may generate reports in printk-unfriendly parts of the
  167. * kernel, such as scheduler code, the use of printk() could deadlock.
  168. * Until such time that all printing code here is safe in all parts of
  169. * the kernel, accept the risk, and just get our message out (given the
  170. * system might already behave unpredictably due to the memory error).
  171. * As such, also disable lockdep to hide warnings, and avoid disabling
  172. * lockdep for the rest of the kernel.
  173. */
  174. lockdep_off();
  175. pr_err("==================================================================\n");
  176. /* Print report header. */
  177. switch (type) {
  178. case KFENCE_ERROR_OOB: {
  179. const bool left_of_object = address < meta->addr;
  180. pr_err("BUG: KFENCE: out-of-bounds %s in %pS\n\n", get_access_type(is_write),
  181. (void *)stack_entries[skipnr]);
  182. pr_err("Out-of-bounds %s at 0x%p (%luB %s of kfence-#%td):\n",
  183. get_access_type(is_write), (void *)address,
  184. left_of_object ? meta->addr - address : address - meta->addr,
  185. left_of_object ? "left" : "right", object_index);
  186. break;
  187. }
  188. case KFENCE_ERROR_UAF:
  189. pr_err("BUG: KFENCE: use-after-free %s in %pS\n\n", get_access_type(is_write),
  190. (void *)stack_entries[skipnr]);
  191. pr_err("Use-after-free %s at 0x%p (in kfence-#%td):\n",
  192. get_access_type(is_write), (void *)address, object_index);
  193. break;
  194. case KFENCE_ERROR_CORRUPTION:
  195. pr_err("BUG: KFENCE: memory corruption in %pS\n\n", (void *)stack_entries[skipnr]);
  196. pr_err("Corrupted memory at 0x%p ", (void *)address);
  197. print_diff_canary(address, 16, meta);
  198. pr_cont(" (in kfence-#%td):\n", object_index);
  199. break;
  200. case KFENCE_ERROR_INVALID:
  201. pr_err("BUG: KFENCE: invalid %s in %pS\n\n", get_access_type(is_write),
  202. (void *)stack_entries[skipnr]);
  203. pr_err("Invalid %s at 0x%p:\n", get_access_type(is_write),
  204. (void *)address);
  205. break;
  206. case KFENCE_ERROR_INVALID_FREE:
  207. pr_err("BUG: KFENCE: invalid free in %pS\n\n", (void *)stack_entries[skipnr]);
  208. pr_err("Invalid free of 0x%p (in kfence-#%td):\n", (void *)address,
  209. object_index);
  210. break;
  211. }
  212. /* Print stack trace and object info. */
  213. stack_trace_print(stack_entries + skipnr, num_stack_entries - skipnr, 0);
  214. if (meta) {
  215. pr_err("\n");
  216. kfence_print_object(NULL, meta);
  217. }
  218. /* Print report footer. */
  219. pr_err("\n");
  220. if (no_hash_pointers && regs)
  221. show_regs(regs);
  222. else
  223. dump_stack_print_info(KERN_ERR);
  224. trace_error_report_end(ERROR_DETECTOR_KFENCE, address);
  225. pr_err("==================================================================\n");
  226. lockdep_on();
  227. if (panic_on_warn)
  228. panic("panic_on_warn set ...\n");
  229. /* We encountered a memory unsafety error, taint the kernel! */
  230. add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK);
  231. }