mm/kasan: print frame description for stack bugs

This adds support for printing stack frame description on invalid stack
accesses.  The frame description is embedded by the compiler, which is
parsed and then pretty-printed.

Currently, we can only print the stack frame info for accesses to the
task's own stack, but not accesses to other tasks' stacks.

Example of what it looks like:

  page dumped because: kasan: bad access detected

  addr ffff8880673ef98a is located in stack of task insmod/2008 at offset 106 in frame:
   kasan_stack_oob+0x0/0xf5 [test_kasan]

  this frame has 2 objects:
   [32, 36) 'i'
   [96, 106) 'stack_array'

  Memory state around the buggy address:

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=198435
Link: http://lkml.kernel.org/r/20190522100048.146841-1-elver@google.com
Signed-off-by: Marco Elver <elver@google.com>
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 3ce956efa0cb804cfd964bbc725857b7aed5d7f1..1979db4763e28815e339c9b6e74c0ef4169f553b 100644 (file)
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -43,6 +43,11 @@
 
 #define KASAN_ALLOCA_REDZONE_SIZE      32
 
+/*
+ * Stack frame marker (compiler ABI).
+ */
+#define KASAN_CURRENT_STACK_FRAME_MAGIC 0x41B58AB3
+
 /* Don't break randconfig/all*config builds */
 #ifndef KASAN_ABI_VERSION
 #define KASAN_ABI_VERSION 1

diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 03a44357938675c84e43d3c5c936a272a7655fde..0e5f965f1882147307f0338376dae12e391e7418 100644 (file)
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -28,6 +28,7 @@
 #include <linux/types.h>
 #include <linux/kasan.h>
 #include <linux/module.h>
+#include <linux/sched/task_stack.h>
 
 #include <asm/sections.h>
 
@@ -181,6 +182,168 @@ static inline bool init_task_stack_addr(const void *addr)
                        sizeof(init_thread_union.stack));
 }
 
+static bool __must_check tokenize_frame_descr(const char **frame_descr,
+                                             char *token, size_t max_tok_len,
+                                             unsigned long *value)
+{
+       const char *sep = strchr(*frame_descr, ' ');
+
+       if (sep == NULL)
+               sep = *frame_descr + strlen(*frame_descr);
+
+       if (token != NULL) {
+               const size_t tok_len = sep - *frame_descr;
+
+               if (tok_len + 1 > max_tok_len) {
+                       pr_err("KASAN internal error: frame description too long: %s\n",
+                              *frame_descr);
+                       return false;
+               }
+
+               /* Copy token (+ 1 byte for '\0'). */
+               strlcpy(token, *frame_descr, tok_len + 1);
+       }
+
+       /* Advance frame_descr past separator. */
+       *frame_descr = sep + 1;
+
+       if (value != NULL && kstrtoul(token, 10, value)) {
+               pr_err("KASAN internal error: not a valid number: %s\n", token);
+               return false;
+       }
+
+       return true;
+}
+
+static void print_decoded_frame_descr(const char *frame_descr)
+{
+       /*
+        * We need to parse the following string:
+        *    "n alloc_1 alloc_2 ... alloc_n"
+        * where alloc_i looks like
+        *    "offset size len name"
+        * or "offset size len name:line".
+        */
+
+       char token[64];
+       unsigned long num_objects;
+
+       if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
+                                 &num_objects))
+               return;
+
+       pr_err("\n");
+       pr_err("this frame has %lu %s:\n", num_objects,
+              num_objects == 1 ? "object" : "objects");
+
+       while (num_objects--) {
+               unsigned long offset;
+               unsigned long size;
+
+               /* access offset */
+               if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
+                                         &offset))
+                       return;
+               /* access size */
+               if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
+                                         &size))
+                       return;
+               /* name length (unused) */
+               if (!tokenize_frame_descr(&frame_descr, NULL, 0, NULL))
+                       return;
+               /* object name */
+               if (!tokenize_frame_descr(&frame_descr, token, sizeof(token),
+                                         NULL))
+                       return;
+
+               /* Strip line number; without filename it's not very helpful. */
+               strreplace(token, ':', '\0');
+
+               /* Finally, print object information. */
+               pr_err(" [%lu, %lu) '%s'", offset, offset + size, token);
+       }
+}
+
+static bool __must_check get_address_stack_frame_info(const void *addr,
+                                                     unsigned long *offset,
+                                                     const char **frame_descr,
+                                                     const void **frame_pc)
+{
+       unsigned long aligned_addr;
+       unsigned long mem_ptr;
+       const u8 *shadow_bottom;
+       const u8 *shadow_ptr;
+       const unsigned long *frame;
+
+       BUILD_BUG_ON(IS_ENABLED(CONFIG_STACK_GROWSUP));
+
+       /*
+        * NOTE: We currently only support printing frame information for
+        * accesses to the task's own stack.
+        */
+       if (!object_is_on_stack(addr))
+               return false;
+
+       aligned_addr = round_down((unsigned long)addr, sizeof(long));
+       mem_ptr = round_down(aligned_addr, KASAN_SHADOW_SCALE_SIZE);
+       shadow_ptr = kasan_mem_to_shadow((void *)aligned_addr);
+       shadow_bottom = kasan_mem_to_shadow(end_of_stack(current));
+
+       while (shadow_ptr >= shadow_bottom && *shadow_ptr != KASAN_STACK_LEFT) {
+               shadow_ptr--;
+               mem_ptr -= KASAN_SHADOW_SCALE_SIZE;
+       }
+
+       while (shadow_ptr >= shadow_bottom && *shadow_ptr == KASAN_STACK_LEFT) {
+               shadow_ptr--;
+               mem_ptr -= KASAN_SHADOW_SCALE_SIZE;
+       }
+
+       if (shadow_ptr < shadow_bottom)
+               return false;
+
+       frame = (const unsigned long *)(mem_ptr + KASAN_SHADOW_SCALE_SIZE);
+       if (frame[0] != KASAN_CURRENT_STACK_FRAME_MAGIC) {
+               pr_err("KASAN internal error: frame info validation failed; invalid marker: %lu\n",
+                      frame[0]);
+               return false;
+       }
+
+       *offset = (unsigned long)addr - (unsigned long)frame;
+       *frame_descr = (const char *)frame[1];
+       *frame_pc = (void *)frame[2];
+
+       return true;
+}
+
+static void print_address_stack_frame(const void *addr)
+{
+       unsigned long offset;
+       const char *frame_descr;
+       const void *frame_pc;
+
+       if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
+               return;
+
+       if (!get_address_stack_frame_info(addr, &offset, &frame_descr,
+                                         &frame_pc))
+               return;
+
+       /*
+        * get_address_stack_frame_info only returns true if the given addr is
+        * on the current task's stack.
+        */
+       pr_err("\n");
+       pr_err("addr %px is located in stack of task %s/%d at offset %lu in frame:\n",
+              addr, current->comm, task_pid_nr(current), offset);
+       pr_err(" %pS\n", frame_pc);
+
+       if (!frame_descr)
+               return;
+
+       print_decoded_frame_descr(frame_descr);
+}
+
 static void print_address_description(void *addr)
 {
        struct page *page = addr_to_page(addr);
@@ -204,6 +367,8 @@ static void print_address_description(void *addr)
                pr_err("The buggy address belongs to the page:\n");
                dump_page(page, "kasan: bad access detected");
        }
+
+       print_address_stack_frame(addr);
 }
 
 static bool row_is_guilty(const void *row, const void *guilty)