1 // SPDX-License-Identifier: GPL-2.0
3 * KMSAN error reporting routines.
5 * Copyright (C) 2019-2022 Google LLC
6 * Author: Alexander Potapenko <glider@google.com>
10 #include <linux/console.h>
11 #include <linux/moduleparam.h>
12 #include <linux/stackdepot.h>
13 #include <linux/stacktrace.h>
14 #include <linux/uaccess.h>
18 static DEFINE_RAW_SPINLOCK(kmsan_report_lock
);
19 #define DESCR_SIZE 128
20 /* Protected by kmsan_report_lock */
21 static char report_local_descr
[DESCR_SIZE
];
22 int panic_on_kmsan __read_mostly
;
24 #ifdef MODULE_PARAM_PREFIX
25 #undef MODULE_PARAM_PREFIX
27 #define MODULE_PARAM_PREFIX "kmsan."
28 module_param_named(panic
, panic_on_kmsan
, int, 0);
31 * Skip internal KMSAN frames.
33 static int get_stack_skipnr(const unsigned long stack_entries
[],
39 for (skip
= 0; skip
< num_entries
; ++skip
) {
40 len
= scnprintf(buf
, sizeof(buf
), "%ps",
41 (void *)stack_entries
[skip
]);
43 /* Never show __msan_* or kmsan_* functions. */
44 if ((strnstr(buf
, "__msan_", len
) == buf
) ||
45 (strnstr(buf
, "kmsan_", len
) == buf
))
49 * No match for runtime functions -- @skip entries to skip to
50 * get to first frame of interest.
59 * Currently the descriptions of locals generated by Clang look as follows:
60 * ----local_name@function_name
61 * We want to print only the name of the local, as other information in that
62 * description can be confusing.
63 * The meaningful part of the description is copied to a global buffer to avoid
66 static char *pretty_descr(char *descr
)
68 int pos
= 0, len
= strlen(descr
);
70 for (int i
= 0; i
< len
; i
++) {
75 report_local_descr
[pos
] = descr
[i
];
76 if (pos
+ 1 == DESCR_SIZE
)
80 report_local_descr
[pos
] = 0;
81 return report_local_descr
;
84 void kmsan_print_origin(depot_stack_handle_t origin
)
86 unsigned long *entries
= NULL
, *chained_entries
= NULL
;
87 unsigned int nr_entries
, chained_nr_entries
, skipnr
;
88 void *pc1
= NULL
, *pc2
= NULL
;
89 depot_stack_handle_t head
;
98 nr_entries
= stack_depot_fetch(origin
, &entries
);
99 depth
= kmsan_depth_from_eb(stack_depot_get_extra_bits(origin
));
100 magic
= nr_entries
? entries
[0] : 0;
101 if ((nr_entries
== 4) && (magic
== KMSAN_ALLOCA_MAGIC_ORIGIN
)) {
102 descr
= (char *)entries
[1];
103 pc1
= (void *)entries
[2];
104 pc2
= (void *)entries
[3];
105 pr_err("Local variable %s created at:\n",
106 pretty_descr(descr
));
108 pr_err(" %pSb\n", pc1
);
110 pr_err(" %pSb\n", pc2
);
113 if ((nr_entries
== 3) && (magic
== KMSAN_CHAIN_MAGIC_ORIGIN
)) {
115 * Origin chains deeper than KMSAN_MAX_ORIGIN_DEPTH are
116 * not stored, so the output may be incomplete.
118 if (depth
== KMSAN_MAX_ORIGIN_DEPTH
)
119 pr_err("<Zero or more stacks not recorded to save memory>\n\n");
122 pr_err("Uninit was stored to memory at:\n");
124 stack_depot_fetch(head
, &chained_entries
);
125 kmsan_internal_unpoison_memory(
127 chained_nr_entries
* sizeof(*chained_entries
),
129 skipnr
= get_stack_skipnr(chained_entries
,
131 stack_trace_print(chained_entries
+ skipnr
,
132 chained_nr_entries
- skipnr
, 0);
136 pr_err("Uninit was created at:\n");
138 skipnr
= get_stack_skipnr(entries
, nr_entries
);
139 stack_trace_print(entries
+ skipnr
, nr_entries
- skipnr
,
142 pr_err("(stack is not available)\n");
148 void kmsan_report(depot_stack_handle_t origin
, void *address
, int size
,
149 int off_first
, int off_last
, const void *user_addr
,
150 enum kmsan_bug_reason reason
)
152 unsigned long stack_entries
[KMSAN_STACK_DEPTH
];
153 int num_stack_entries
, skipnr
;
154 char *bug_type
= NULL
;
155 unsigned long ua_flags
;
160 if (!current
->kmsan_ctx
.allow_reporting
)
165 current
->kmsan_ctx
.allow_reporting
= false;
166 ua_flags
= user_access_save();
167 raw_spin_lock(&kmsan_report_lock
);
168 pr_err("=====================================================\n");
169 is_uaf
= kmsan_uaf_from_eb(stack_depot_get_extra_bits(origin
));
172 bug_type
= is_uaf
? "use-after-free" : "uninit-value";
174 case REASON_COPY_TO_USER
:
175 bug_type
= is_uaf
? "kernel-infoleak-after-free" :
178 case REASON_SUBMIT_URB
:
179 bug_type
= is_uaf
? "kernel-usb-infoleak-after-free" :
180 "kernel-usb-infoleak";
185 stack_trace_save(stack_entries
, KMSAN_STACK_DEPTH
, 1);
186 skipnr
= get_stack_skipnr(stack_entries
, num_stack_entries
);
188 pr_err("BUG: KMSAN: %s in %pSb\n", bug_type
,
189 (void *)stack_entries
[skipnr
]);
190 stack_trace_print(stack_entries
+ skipnr
, num_stack_entries
- skipnr
,
194 kmsan_print_origin(origin
);
198 if (off_first
== off_last
)
199 pr_err("Byte %d of %d is uninitialized\n", off_first
,
202 pr_err("Bytes %d-%d of %d are uninitialized\n",
203 off_first
, off_last
, size
);
206 pr_err("Memory access of size %d starts at %px\n", size
,
208 if (user_addr
&& reason
== REASON_COPY_TO_USER
)
209 pr_err("Data copied to user address %px\n", user_addr
);
211 dump_stack_print_info(KERN_ERR
);
212 pr_err("=====================================================\n");
213 add_taint(TAINT_BAD_PAGE
, LOCKDEP_NOW_UNRELIABLE
);
214 raw_spin_unlock(&kmsan_report_lock
);
216 panic("kmsan.panic set ...\n");
217 user_access_restore(ua_flags
);
218 current
->kmsan_ctx
.allow_reporting
= true;