From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754218AbcHAQTo (ORCPT ); Mon, 1 Aug 2016 12:19:44 -0400 Received: from mail-db5eur01on0107.outbound.protection.outlook.com ([104.47.2.107]:32160 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754200AbcHAQTd (ORCPT ); Mon, 1 Aug 2016 12:19:33 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: Andrew Morton CC: Alexander Potapenko , Dave Jones , Vegard Nossum , "Sasha Levin" , Dmitry Vyukov , , , , Andrey Ryabinin Subject: [PATCH 6/6] kasan: improve double-free reports. Date: Mon, 1 Aug 2016 17:45:15 +0300 Message-ID: <1470062715-14077-6-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1470062715-14077-1-git-send-email-aryabinin@virtuozzo.com> References: <1470062715-14077-1-git-send-email-aryabinin@virtuozzo.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM3PR08CA0029.eurprd08.prod.outlook.com (10.160.207.167) To VI1PR0801MB1982.eurprd08.prod.outlook.com (10.173.74.15) X-MS-Office365-Filtering-Correlation-Id: 302749df-6e75-47cd-8d4b-08d3ba1a4e79 X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;2:kCfTdKup8iWET8zdFZK6p80ohhsWzc3W/ihMJ76CRkd2REYUVSX4o6PoOQZ9aL+NF7KfRq8n6HWRWbSLDX02k4FStIyEg2tfkRE5iUB/WMA3Is3WR8bi9tN31YhsnBtvpvNHZx5y3mWV7Iu2H57RVoyCiwVY6baPOA2NMNZkSg1p/eLxeyaE6pEpOYwVI0YL;3:H9qmKM7rnjrMmNdxGx74OHyiD21KETrD8nbXUY5d/TSiC5SuL9mP8sDPjzejdkNj6kghGIsc76tUgaQ9H7JQ1UA2z0s5A3FmqERMFZ14Lk6MviiWQJpeL4kbxrf5iwzD;25:6spDJ16aTTOtYNaXO4XcznUeqUt2AP7gUu9AcyZy4rTqKXMHLHczgofUNH4MJYjM0+MStNkWTAbD9AvMIpPsf6lLSaZnHQ8BFbD0A27WOEALTpgN93o93WYvWmONpmaWUjwCaPoHTT5M9JfI3qFcmD59SwhdBRRIxPIpEeUe4yFmi+JtDO3s8uJcUjyGc18UouF+Wu08dkpzLv4VKYGLKvt0G6840LODnNAdmG3zmOgI2cLr5beSv3VOd21/I81BlPElKV8wGJOw7ekRvRaLK1hWR518b16+QFoDquZ0TE79KkgUt8auO0AJC/FMsJHJRI8arRCyvGlz9JxzoRG0nx/mW2laGj333MyIqemiUGpvUvGEqt+ez6F+2hIZGcHEKcFoO8WQ2rEX1vEPCIiJ33e2H0plgSSo7cN+Zi/oJ7c= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1982; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;31:kRgZQHIGZZJ77aPAniOc4VT4cvLpIIMxJ/VMnYf7xtdafYKeRGNM0ukctYckmhFEj9Z26VLazZPqMD3aIK5lGMZvGSWRaSKp7ORSL8QIF4R/fr8MfRVTgtI8Ap70yNCC1XbF07LLaDxP7SXrVA911OX6Fqsrj2Ney8VyOC9Dt4sia+eQeArTLgIGBu+XcQPq9VWBLYc5oFtJ4bLpNhR1MrxfYtF4VC/jd8ciupWkOW0=;4:o+tS0xtsdo3WG02IwKrGRCTcKXVILIdP9TrZICfT/HBwi6HKBLZRiroxg5kiN9TxOd7417Q/WS9us8cD5g3fMc+qJ/Y7D3eq5UQo7L1oRSRyNXuyZXw/pjPy+EwC+8VMY7c/JeN3R19zCc4DVItphuzBBVNE8paS2ueK531UFPoUnwig508Fa/7Kwwzf3kiBNNLnpYCKIk0EGeTR/OVGbred1MgrNnvevi9260ht5cgdTRIZf9yj0GUMBIF3G+deD5JhlKW+d+tIudIJe8rnH9Z6d46cbh3vZtK919XnfLTbcKNIQXfvgmzhGMYMrImOagn8z/3LfsgtuAJ0gJss3ktZXPC3BLeYA2ZM3/kyVHVU3OYaNCUxY6UrWcKAs9DK3GkXC4RqnH5FMlLtU5EDGffL2g8GGSWuOWGIl9KMSQg= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041072)(6043046);SRVR:VI1PR0801MB1982;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1982; X-Forefront-PRVS: 0021920B5A X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6069001)(7916002)(199003)(189002)(97736004)(92566002)(76176999)(36756003)(47776003)(8676002)(101416001)(81166006)(42186005)(81156014)(189998001)(3846002)(6116002)(5003940100001)(107886002)(4326007)(50466002)(110136002)(305945005)(48376002)(66066001)(586003)(69596002)(4001430100002)(2906002)(77096005)(50226002)(86362001)(33646002)(106356001)(2950100001)(229853001)(68736007)(50986999)(19580405001)(19580395003)(53416004)(7846002)(7736002)(105586002)(76506005)(21643005);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB1982;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;VI1PR0801MB1982;23:3sMSD6xSbHA/lAkwqeIaeAcx6X35fwTf7YQDKKU?= =?us-ascii?Q?M0Au0FnlZuC58RL/EOdanawmHEqFm6fR8Imjv/44MBuk2vpuwZsc+0BBWuvr?= =?us-ascii?Q?gpqsOfTEK4otJzDklbhgnsXoN9teck/jg6g6ornwNSiehnukosd4KtkBuhsJ?= =?us-ascii?Q?A/ofafy9py7tR39i5eMm5b5aSeek3wAV3WpNF+AxMGc/6fszkp+ICMVEF9aQ?= =?us-ascii?Q?vB6r1pB3d9M17sf6UN0dJVBV5F48+ML8vS6WbTZUsnAonHAkIRpz0cUVWOJ2?= =?us-ascii?Q?eImXeRQZjNocO5u1/awAKYJLdWTNEKiUwoLuKbgr+6JglLMTadwUxa7WhTeV?= =?us-ascii?Q?YBWZOVWLDF9U9Utq9nbs89WU6Fnk/uqZB4WDl930US4+Gk/b9MimWLnX2t/t?= =?us-ascii?Q?iih5iJueC251Hosgxd22+gX89AUC/AFCfHbIgubFumEn9r+a+q+YcVBASw8E?= =?us-ascii?Q?Wa59xXDnD5GtABWt4r0skEQ41dQz4/22Jq39gxVAxwMCfxQ9dlI4jaZs0nSG?= =?us-ascii?Q?4F6ZJB72lInZ/ED2y6wbMyBF/ss1NZBeAML8z89p8yiYn+Q8v6fAKa4RwicP?= =?us-ascii?Q?NbfdUCrfYif7qEujb0b07fRjKBGPAGyIabWiWB47cqkDeIgByGMAwMlFYmP3?= =?us-ascii?Q?nHlS/GsqU8Q9KyzuPVYK3i2uyNhCoy0Cdsi7RSSaGMfT7EhwuDzpjosxW9a3?= =?us-ascii?Q?xiXtNL5479g7QbHlAdc4wieTMxMqXqZDODvEDwSht1czz/8PZmtJ3HbHLSMi?= =?us-ascii?Q?0mSUnbRh/6V1RJiWYb4v0exDj49huKCmSGwSjOzdCUDTt5EjIYAOsXwIKWR6?= =?us-ascii?Q?LEyr703d8/IyaAAbXHgyaTq6xFAlanMObU4FeMGjV7bnZcfCEf4DwXpCYI/f?= =?us-ascii?Q?xOfIIVVXoMUh14nulqVzAq3OrvkcnZxDkNSqPeo6hDRcNZk8CQggd8gwJ/sr?= =?us-ascii?Q?Up9ULWEzk7Sc+5MJhPSeWxgJFE4CokPH5hmPezmXgwVcgg1eM7H1OYKSvMcf?= =?us-ascii?Q?fonOj1xNgCPzpVDMV2vyAzSJNMAnMlYRRO2OgPbQmbcB6BFruh1yi3MNN7EK?= =?us-ascii?Q?jIp/39Et30/RleyAguoEJOLXdzobWNMU3oYRnKiZzAj+kXUb9nzWIJwo8ozx?= =?us-ascii?Q?1FLlGOR9fkEadT0CpDzPxnmKD6oj1TKz1T8J7e/M/Al8mGULnNXsHjnNd7li?= =?us-ascii?Q?zw0RNjEpJeq0jVwYsAmPy17GY0I9rZYlT717k?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;6:14HsRQGjgF6pf/ciPHUCNfg2HQwhcmMdNSwnYgnPBWuRJ3nmHKlgLj3sfnuBMVLu/9khbxG6NXq2wrk93OTHYFC59TakghJbJsoeP5Z71ImNeU8kfPNuTENDWjkOSv/z3nVQh9p/so88S+9EeC5lEpf7JxsbOA15UZ5bbDdpK2e1RrbOO8HoOCVRpJ0dZefB3naZ0tAl7YloxAvaR0bHEMhlvnmf6Y9fa4IHlJdF8IG5oyrO27Rxd7mJNCbwCc+SfsCQOe4DMMe7jCOxSpRwLxp2yURPPa7tgdcbnTtDWROwXXUNX4TqkPxa5zzpDwca;5:9LH/ZUOxFol3PlDf985tMQgvoFlSW7HS9VlxKQRDGR0Tq3GhEZWpOFMj/l+7VgYZbKL0+mUzaZK683BSW5N//bbr6ogJRUNgBnjTPBKhekesuXh6+ZcBd0/GntCuIbEoRa7QEGyDdPof2sYs0uPv0w==;24:FpbPZj2YlaIjN1TOOIdDisi2VIB/B+i4EClnOo1EmzNmYHJ9cOHpYrcYC2I6YtXZy3Q2GO/xUZIBt5TkTNDl2Coeht7/BgdZvgZwppYhy0Q=;7:+aEbSwZxQJsG04fTFwd/x/xcktHJvy4em8gEn6bQT1MY/aeREqTpJNdW6pPoLzvr/dGWPvdKoPuQUq1wWsnAPDt/0PgbMvsDyI4yPQlroQ96MRDIWLI3R+6tIA8tIirWGhZwnfr/9qCJyLyqeBe4tFtbgv+IfgK4GGf0s97MfjFFGxHBzN77SlzaOZrWQSd0sx+jeVWr/14PXNKxSK65tOH0pt6pergH9I6W2UH89WF7H1lGgKtv2zUnOzy8jp/1 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;20:8NXCbj6Slc/eeX3yofmrBwyugMLJRGGsTijQGZRKHQoBOn4A+BPJ53i7jfSK9EElUlzSQEVcLoYP7cYbutWJA1aVmjOjUnK5wckFT5MpTscivANdFhGdiPhccyWkqtsl0luILe91NOEKzfgJOs7lEdrRIKU5sTfJU0WMTMjVc0A= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Aug 2016 14:44:12.9299 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1982 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Currently we just dump stack in case of double free bug. Let's dump all info about the object that we have. Signed-off-by: Andrey Ryabinin --- mm/kasan/kasan.c | 3 +-- mm/kasan/kasan.h | 2 ++ mm/kasan/report.c | 54 ++++++++++++++++++++++++++++++++++++++---------------- 3 files changed, 41 insertions(+), 18 deletions(-) diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c index 92750e3..88af13c 100644 --- a/mm/kasan/kasan.c +++ b/mm/kasan/kasan.c @@ -543,8 +543,7 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object) shadow_byte = READ_ONCE(*(s8 *)kasan_mem_to_shadow(object)); if (shadow_byte < 0 || shadow_byte >= KASAN_SHADOW_SCALE_SIZE) { - pr_err("Double free"); - dump_stack(); + kasan_report_double_free(cache, object, shadow_byte); return true; } diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 9b7b31e..e5c2181 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -99,6 +99,8 @@ static inline bool kasan_report_enabled(void) void kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip); +void kasan_report_double_free(struct kmem_cache *cache, void *object, + s8 shadow); #if defined(CONFIG_SLAB) || defined(CONFIG_SLUB) void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache); diff --git a/mm/kasan/report.c b/mm/kasan/report.c index f437398..ee2bdb4 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -116,6 +116,26 @@ static inline bool init_task_stack_addr(const void *addr) sizeof(init_thread_union.stack)); } +static DEFINE_SPINLOCK(report_lock); + +static void kasan_start_report(unsigned long *flags) +{ + /* + * Make sure we don't end up in loop. + */ + kasan_disable_current(); + spin_lock_irqsave(&report_lock, *flags); + pr_err("==================================================================\n"); +} + +static void kasan_end_report(unsigned long *flags) +{ + pr_err("==================================================================\n"); + add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); + spin_unlock_irqrestore(&report_lock, *flags); + kasan_enable_current(); +} + static void print_track(struct kasan_track *track) { pr_err("PID = %u\n", track->pid); @@ -129,8 +149,7 @@ static void print_track(struct kasan_track *track) } } -static void kasan_object_err(struct kmem_cache *cache, struct page *page, - void *object, char *unused_reason) +static void kasan_object_err(struct kmem_cache *cache, void *object) { struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object); @@ -147,6 +166,18 @@ static void kasan_object_err(struct kmem_cache *cache, struct page *page, print_track(&alloc_info->free_track); } +void kasan_report_double_free(struct kmem_cache *cache, void *object, + s8 shadow) +{ + unsigned long flags; + + kasan_start_report(&flags); + pr_err("BUG: Double free or corrupt pointer\n"); + pr_err("Unexpected shadow byte: 0x%hhX\n", shadow); + kasan_object_err(cache, object); + kasan_end_report(&flags); +} + static void print_address_description(struct kasan_access_info *info) { const void *addr = info->access_addr; @@ -160,8 +191,7 @@ static void print_address_description(struct kasan_access_info *info) struct kmem_cache *cache = page->slab_cache; object = nearest_obj(cache, page, (void *)info->access_addr); - kasan_object_err(cache, page, object, - "kasan: bad access detected"); + kasan_object_err(cache, object); return; } dump_page(page, "kasan: bad access detected"); @@ -226,19 +256,13 @@ static void print_shadow_for_address(const void *addr) } } -static DEFINE_SPINLOCK(report_lock); - static void kasan_report_error(struct kasan_access_info *info) { unsigned long flags; const char *bug_type; - /* - * Make sure we don't end up in loop. - */ - kasan_disable_current(); - spin_lock_irqsave(&report_lock, flags); - pr_err("==================================================================\n"); + kasan_start_report(&flags); + if (info->access_addr < kasan_shadow_to_mem((void *)KASAN_SHADOW_START)) { if ((unsigned long)info->access_addr < PAGE_SIZE) @@ -259,10 +283,8 @@ static void kasan_report_error(struct kasan_access_info *info) print_address_description(info); print_shadow_for_address(info->first_bad_addr); } - pr_err("==================================================================\n"); - add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); - spin_unlock_irqrestore(&report_lock, flags); - kasan_enable_current(); + + kasan_end_report(&flags); } void kasan_report(unsigned long addr, size_t size, -- 2.7.3