• Kuan-Ying Lee's avatar
    kasan: infer allocation size by scanning metadata · 8f17febb
    Kuan-Ying Lee authored
    Make KASAN scan metadata to infer the requested allocation size instead of
    printing cache->object_size.
    
    This patch fixes confusing slab-out-of-bounds reports as reported in:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=216457
    
    As an example of the confusing behavior, the report below hints that the
    allocation size was 192, while the kernel actually called kmalloc(184):
    
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in _find_next_bit+0x143/0x160 lib/find_bit.c:109
    Read of size 8 at addr ffff8880175766b8 by task kworker/1:1/26
    ...
    The buggy address belongs to the object at ffff888017576600
     which belongs to the cache kmalloc-192 of size 192
    The buggy address is located 184 bytes inside of
     192-byte region [ffff888017576600, ffff8880175766c0)
    ...
    Memory state around the buggy address:
     ffff888017576580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
     ffff888017576600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >ffff888017576680: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
                                            ^
     ffff888017576700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     ffff888017576780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ==================================================================
    
    With this patch, the report shows:
    
    ==================================================================
    ...
    The buggy address belongs to the object at ffff888017576600
     which belongs to the cache kmalloc-192 of size 192
    The buggy address is located 0 bytes to the right of
     allocated 184-byte region [ffff888017576600, ffff8880175766b8)
    ...
    ==================================================================
    
    Also report slab use-after-free bugs as "slab-use-after-free" and print
    "freed" instead of "allocated" in the report when describing the accessed
    memory region.
    
    Also improve the metadata-related comment in kasan_find_first_bad_addr
    and use addr_has_metadata across KASAN code instead of open-coding
    KASAN_SHADOW_START checks.
    
    [akpm@linux-foundation.org: fix printk warning]
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216457
    Link: https://lkml.kernel.org/r/20230129021437.18812-1-Kuan-Ying.Lee@mediatek.comSigned-off-by: default avatarKuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
    Co-developed-by: default avatarAndrey Konovalov <andreyknvl@gmail.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
    Cc: Chinwen Chang <chinwen.chang@mediatek.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Matthias Brugger <matthias.bgg@gmail.com>
    Cc: Qun-Wei Lin <qun-wei.lin@mediatek.com>
    Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    8f17febb
report_generic.c 10.3 KB