Merge tag 'mm-stable-2024-01-08-15-31' of git://git.kernel.org/pub/scm/linux/kernel...

[linux-2.6-microblaze.git] / mm / kasan / report.c

diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 011f727..7afa4fe 100644 (file)
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -263,7 +263,19 @@ static void print_error_description(struct kasan_report_info *info)
 
 static void print_track(struct kasan_track *track, const char *prefix)
 {
+#ifdef CONFIG_KASAN_EXTRA_INFO
+       u64 ts_nsec = track->timestamp;
+       unsigned long rem_usec;
+
+       ts_nsec <<= 3;
+       rem_usec = do_div(ts_nsec, NSEC_PER_SEC) / 1000;
+
+       pr_err("%s by task %u on cpu %d at %lu.%06lus:\n",
+                       prefix, track->pid, track->cpu,
+                       (unsigned long)ts_nsec, rem_usec);
+#else
        pr_err("%s by task %u:\n", prefix, track->pid);
+#endif /* CONFIG_KASAN_EXTRA_INFO */
        if (track->stack)
                stack_depot_print(track->stack);
        else
@@ -624,37 +636,43 @@ void kasan_report_async(void)
 
 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
 /*
- * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high
- * canonical half of the address space) cause out-of-bounds shadow memory reads
- * before the actual access. For addresses in the low canonical half of the
- * address space, as well as most non-canonical addresses, that out-of-bounds
- * shadow memory access lands in the non-canonical part of the address space.
- * Help the user figure out what the original bogus pointer was.
+ * With compiler-based KASAN modes, accesses to bogus pointers (outside of the
+ * mapped kernel address space regions) cause faults when KASAN tries to check
+ * the shadow memory before the actual memory access. This results in cryptic
+ * GPF reports, which are hard for users to interpret. This hook helps users to
+ * figure out what the original bogus pointer was.
  */
 void kasan_non_canonical_hook(unsigned long addr)
 {
        unsigned long orig_addr;
        const char *bug_type;
 
+       /*
+        * All addresses that came as a result of the memory-to-shadow mapping
+        * (even for bogus pointers) must be >= KASAN_SHADOW_OFFSET.
+        */
        if (addr < KASAN_SHADOW_OFFSET)
                return;
 
-       orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT;
+       orig_addr = (unsigned long)kasan_shadow_to_mem((void *)addr);
+
        /*
         * For faults near the shadow address for NULL, we can be fairly certain
         * that this is a KASAN shadow memory access.
-        * For faults that correspond to shadow for low canonical addresses, we
-        * can still be pretty sure - that shadow region is a fairly narrow
-        * chunk of the non-canonical address space.
-        * But faults that look like shadow for non-canonical addresses are a
-        * really large chunk of the address space. In that case, we still
-        * print the decoded address, but make it clear that this is not
-        * necessarily what's actually going on.
+        * For faults that correspond to the shadow for low or high canonical
+        * addresses, we can still be pretty sure: these shadow regions are a
+        * fairly narrow chunk of the address space.
+        * But the shadow for non-canonical addresses is a really large chunk
+        * of the address space. For this case, we still print the decoded
+        * address, but make it clear that this is not necessarily what's
+        * actually going on.
         */
        if (orig_addr < PAGE_SIZE)
                bug_type = "null-ptr-deref";
        else if (orig_addr < TASK_SIZE)
                bug_type = "probably user-memory-access";
+       else if (addr_in_shadow((void *)addr))
+               bug_type = "probably wild-memory-access";
        else
                bug_type = "maybe wild-memory-access";
        pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,