^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * KFENCE reporting.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Copyright (C) 2020, Google LLC.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include <stdarg.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/lockdep.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/printk.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/sched/debug.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/seq_file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/stacktrace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <trace/events/error_report.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <asm/kfence.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include "kfence.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) /* May be overridden by <asm/kfence.h>. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #ifndef ARCH_FUNC_PREFIX
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #define ARCH_FUNC_PREFIX ""
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) extern bool no_hash_pointers;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) /* Helper function to either print to a seq_file or to console. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) __printf(2, 3)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) static void seq_con_printf(struct seq_file *seq, const char *fmt, ...)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) va_list args;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) va_start(args, fmt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) if (seq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) seq_vprintf(seq, fmt, args);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) vprintk(fmt, args);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) va_end(args);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) * Get the number of stack entries to skip to get out of MM internals. @type is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) * optional, and if set to NULL, assumes an allocation or free stack.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) static int get_stack_skipnr(const unsigned long stack_entries[], int num_entries,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) const enum kfence_error_type *type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) char buf[64];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) int skipnr, fallback = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) if (type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) /* Depending on error type, find different stack entries. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) switch (*type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) case KFENCE_ERROR_UAF:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) case KFENCE_ERROR_OOB:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) case KFENCE_ERROR_INVALID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * kfence_handle_page_fault() may be called with pt_regs
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * set to NULL; in that case we'll simply show the full
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) * stack trace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) case KFENCE_ERROR_CORRUPTION:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) case KFENCE_ERROR_INVALID_FREE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) for (skipnr = 0; skipnr < num_entries; skipnr++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) int len = scnprintf(buf, sizeof(buf), "%ps", (void *)stack_entries[skipnr]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) if (str_has_prefix(buf, ARCH_FUNC_PREFIX "kfence_") ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) str_has_prefix(buf, ARCH_FUNC_PREFIX "__kfence_") ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) !strncmp(buf, ARCH_FUNC_PREFIX "__slab_free", len)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) * In case of tail calls from any of the below
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) * to any of the above.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) fallback = skipnr + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) /* Also the *_bulk() variants by only checking prefixes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) if (str_has_prefix(buf, ARCH_FUNC_PREFIX "kfree") ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) str_has_prefix(buf, ARCH_FUNC_PREFIX "kmem_cache_free") ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) str_has_prefix(buf, ARCH_FUNC_PREFIX "__kmalloc") ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) str_has_prefix(buf, ARCH_FUNC_PREFIX "kmem_cache_alloc"))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) goto found;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (fallback < num_entries)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return fallback;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) found:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) skipnr++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) return skipnr < num_entries ? skipnr : 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) static void kfence_print_stack(struct seq_file *seq, const struct kfence_metadata *meta,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) bool show_alloc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) const struct kfence_track *track = show_alloc ? &meta->alloc_track : &meta->free_track;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) if (track->num_stack_entries) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) /* Skip allocation/free internals stack. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) int i = get_stack_skipnr(track->stack_entries, track->num_stack_entries, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) /* stack_trace_seq_print() does not exist; open code our own. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) for (; i < track->num_stack_entries; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) seq_con_printf(seq, " %pS\n", (void *)track->stack_entries[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) seq_con_printf(seq, " no %s stack\n", show_alloc ? "allocation" : "deallocation");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) void kfence_print_object(struct seq_file *seq, const struct kfence_metadata *meta)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) const int size = abs(meta->size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) const unsigned long start = meta->addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) const struct kmem_cache *const cache = meta->cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) lockdep_assert_held(&meta->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) if (meta->state == KFENCE_OBJECT_UNUSED) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) seq_con_printf(seq, "kfence-#%td unused\n", meta - kfence_metadata);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) seq_con_printf(seq,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) "kfence-#%td [0x%p-0x%p"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) ", size=%d, cache=%s] allocated by task %d:\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) meta - kfence_metadata, (void *)start, (void *)(start + size - 1), size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) (cache && cache->name) ? cache->name : "<destroyed>", meta->alloc_track.pid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) kfence_print_stack(seq, meta, true);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) if (meta->state == KFENCE_OBJECT_FREED) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) seq_con_printf(seq, "\nfreed by task %d:\n", meta->free_track.pid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) kfence_print_stack(seq, meta, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) * Show bytes at @addr that are different from the expected canary values, up to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) * @max_bytes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) static void print_diff_canary(unsigned long address, size_t bytes_to_show,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) const struct kfence_metadata *meta)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) const unsigned long show_until_addr = address + bytes_to_show;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) const u8 *cur, *end;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) /* Do not show contents of object nor read into following guard page. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) end = (const u8 *)(address < meta->addr ? min(show_until_addr, meta->addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) : min(show_until_addr, PAGE_ALIGN(address)));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) pr_cont("[");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) for (cur = (const u8 *)address; cur < end; cur++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) if (*cur == KFENCE_CANARY_PATTERN(cur))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) pr_cont(" .");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) else if (no_hash_pointers)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) pr_cont(" 0x%02x", *cur);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) else /* Do not leak kernel memory in non-debug builds. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) pr_cont(" !");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) pr_cont(" ]");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) static const char *get_access_type(bool is_write)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) return is_write ? "write" : "read";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *regs,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) const struct kfence_metadata *meta, enum kfence_error_type type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) unsigned long stack_entries[KFENCE_STACK_DEPTH] = { 0 };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) const ptrdiff_t object_index = meta ? meta - kfence_metadata : -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) int num_stack_entries;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) int skipnr = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) if (regs) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) num_stack_entries = stack_trace_save_regs(regs, stack_entries, KFENCE_STACK_DEPTH, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) num_stack_entries = stack_trace_save(stack_entries, KFENCE_STACK_DEPTH, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) skipnr = get_stack_skipnr(stack_entries, num_stack_entries, &type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) /* Require non-NULL meta, except if KFENCE_ERROR_INVALID. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) if (meta)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) lockdep_assert_held(&meta->lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) * Because we may generate reports in printk-unfriendly parts of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) * kernel, such as scheduler code, the use of printk() could deadlock.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) * Until such time that all printing code here is safe in all parts of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) * the kernel, accept the risk, and just get our message out (given the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) * system might already behave unpredictably due to the memory error).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) * As such, also disable lockdep to hide warnings, and avoid disabling
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) * lockdep for the rest of the kernel.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) lockdep_off();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) pr_err("==================================================================\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) /* Print report header. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) switch (type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) case KFENCE_ERROR_OOB: {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) const bool left_of_object = address < meta->addr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) pr_err("BUG: KFENCE: out-of-bounds %s in %pS\n\n", get_access_type(is_write),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) (void *)stack_entries[skipnr]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) pr_err("Out-of-bounds %s at 0x%p (%luB %s of kfence-#%td):\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) get_access_type(is_write), (void *)address,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) left_of_object ? meta->addr - address : address - meta->addr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) left_of_object ? "left" : "right", object_index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) case KFENCE_ERROR_UAF:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) pr_err("BUG: KFENCE: use-after-free %s in %pS\n\n", get_access_type(is_write),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) (void *)stack_entries[skipnr]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) pr_err("Use-after-free %s at 0x%p (in kfence-#%td):\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) get_access_type(is_write), (void *)address, object_index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) case KFENCE_ERROR_CORRUPTION:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) pr_err("BUG: KFENCE: memory corruption in %pS\n\n", (void *)stack_entries[skipnr]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) pr_err("Corrupted memory at 0x%p ", (void *)address);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) print_diff_canary(address, 16, meta);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) pr_cont(" (in kfence-#%td):\n", object_index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) case KFENCE_ERROR_INVALID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) pr_err("BUG: KFENCE: invalid %s in %pS\n\n", get_access_type(is_write),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) (void *)stack_entries[skipnr]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) pr_err("Invalid %s at 0x%p:\n", get_access_type(is_write),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) (void *)address);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) case KFENCE_ERROR_INVALID_FREE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) pr_err("BUG: KFENCE: invalid free in %pS\n\n", (void *)stack_entries[skipnr]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) pr_err("Invalid free of 0x%p (in kfence-#%td):\n", (void *)address,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) object_index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) /* Print stack trace and object info. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) stack_trace_print(stack_entries + skipnr, num_stack_entries - skipnr, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) if (meta) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) pr_err("\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) kfence_print_object(NULL, meta);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) /* Print report footer. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) pr_err("\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) if (no_hash_pointers && regs)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) show_regs(regs);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) dump_stack_print_info(KERN_ERR);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) trace_error_report_end(ERROR_DETECTOR_KFENCE, address);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) pr_err("==================================================================\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) lockdep_on();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) if (panic_on_warn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) panic("panic_on_warn set ...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) /* We encountered a memory unsafety error, taint the kernel! */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags