Commit 1f538e1f authored by Andrey Konovalov's avatar Andrey Konovalov Committed by Andrew Morton
Browse files

kasan: better identify bug types for tag-based modes 

Identify the bug type for the tag-based modes based on the stack trace
entries found in the stack ring.

If a free entry is found first (meaning that it was added last), mark the
bug as use-after-free.  If an alloc entry is found first, mark the bug as
slab-out-of-bounds.  Otherwise, assign the common bug type.

This change returns the functionalify of the previously dropped
CONFIG_KASAN_TAGS_IDENTIFY.

Link: https://lkml.kernel.org/r/13ce7fa07d9d995caedd1439dfae4d51401842f2.1662411800.git.andreyknvl@google.com


Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Reviewed-by: default avatarMarco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 80b92bfe

mm/kasan/report_tags.c

+21 −4
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ 


extern struct kasan_stack_ring stack_ring;



static const char *get_bug_type(struct kasan_report_info *info)

static const char *get_common_bug_type(struct kasan_report_info *info)

{

	/*

	 * If access_size is a negative number, then it has reason to be
@@ -37,9 +37,8 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 
	bool is_free;

	bool alloc_found = false, free_found = false;



	info->bug_type = get_bug_type(info);



	if (!info->cache || !info->object)

	if (!info->cache || !info->object) {

		info->bug_type = get_common_bug_type(info);

		return;

	}
@@ -84,6 +83,13 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 
			info->free_track.pid = pid;

			info->free_track.stack = stack;

			free_found = true;



			/*

			 * If a free entry is found first, the bug is likely

			 * a use-after-free.

			 */

			if (!info->bug_type)

				info->bug_type = "use-after-free";

		} else {

			/* Second alloc of the same object. Give up. */

			if (alloc_found)
@@ -92,8 +98,19 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 
			info->alloc_track.pid = pid;

			info->alloc_track.stack = stack;

			alloc_found = true;



			/*

			 * If an alloc entry is found first, the bug is likely

			 * an out-of-bounds.

			 */

			if (!info->bug_type)

				info->bug_type = "slab-out-of-bounds";

		}

	}



	write_unlock_irqrestore(&stack_ring.lock, flags);



	/* Assign the common bug type if no entries were found. */

	if (!info->bug_type)

		info->bug_type = get_common_bug_type(info);

}