1 // SPDX-License-Identifier: GPL-2.0
3 * This file contains tag-based KASAN specific error reporting code.
5 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
6 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
8 * Some code borrowed from https://github.com/xairy/kasan-prototype by
9 * Andrey Konovalov <andreyknvl@gmail.com>
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2 as
13 * published by the Free Software Foundation.
17 #include <linux/bitops.h>
18 #include <linux/ftrace.h>
19 #include <linux/init.h>
20 #include <linux/kernel.h>
22 #include <linux/printk.h>
23 #include <linux/sched.h>
24 #include <linux/slab.h>
25 #include <linux/stackdepot.h>
26 #include <linux/stacktrace.h>
27 #include <linux/string.h>
28 #include <linux/types.h>
29 #include <linux/kasan.h>
30 #include <linux/module.h>
32 #include <asm/sections.h>
37 const char *get_bug_type(struct kasan_access_info *info)
39 #ifdef CONFIG_KASAN_SW_TAGS_IDENTIFY
40 struct kasan_alloc_meta *alloc_meta;
41 struct kmem_cache *cache;
48 tag = get_tag(info->access_addr);
49 addr = reset_tag(info->access_addr);
50 page = kasan_addr_to_page(addr);
51 if (page && PageSlab(page)) {
52 cache = page->slab_cache;
53 object = nearest_obj(cache, page, (void *)addr);
54 alloc_meta = get_alloc_info(cache, object);
56 for (i = 0; i < KASAN_NR_FREE_STACKS; i++)
57 if (alloc_meta->free_pointer_tag[i] == tag)
58 return "use-after-free";
59 return "out-of-bounds";
64 * If access_size is a negative number, then it has reason to be
65 * defined as out-of-bounds bug type.
67 * Casting negative numbers to size_t would indeed turn up as
68 * a large size_t and its value will be larger than ULONG_MAX/2,
69 * so that this can qualify as out-of-bounds.
71 if (info->access_addr + info->access_size < info->access_addr)
72 return "out-of-bounds";
74 return "invalid-access";
77 void *find_first_bad_addr(void *addr, size_t size)
79 u8 tag = get_tag(addr);
80 void *p = reset_tag(addr);
83 while (p < end && tag == *(u8 *)kasan_mem_to_shadow(p))
84 p += KASAN_SHADOW_SCALE_SIZE;
88 void print_tags(u8 addr_tag, const void *addr)
90 u8 *shadow = (u8 *)kasan_mem_to_shadow(addr);
92 pr_err("Pointer tag: [%02x], memory tag: [%02x]\n", addr_tag, *shadow);