1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * UBSAN error reporting functions |
4 | * |
5 | * Copyright (c) 2014 Samsung Electronics Co., Ltd. |
6 | * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> |
7 | */ |
8 | |
9 | #include <linux/bitops.h> |
10 | #include <linux/bug.h> |
11 | #include <linux/ctype.h> |
12 | #include <linux/init.h> |
13 | #include <linux/kernel.h> |
14 | #include <linux/types.h> |
15 | #include <linux/sched.h> |
16 | #include <linux/uaccess.h> |
17 | #include <linux/ubsan.h> |
18 | #include <kunit/test-bug.h> |
19 | |
20 | #include "ubsan.h" |
21 | |
22 | #ifdef CONFIG_UBSAN_TRAP |
23 | /* |
24 | * Only include matches for UBSAN checks that are actually compiled in. |
25 | * The mappings of struct SanitizerKind (the -fsanitize=xxx args) to |
26 | * enum SanitizerHandler (the traps) in Clang is in clang/lib/CodeGen/. |
27 | */ |
28 | const char *report_ubsan_failure(struct pt_regs *regs, u32 check_type) |
29 | { |
30 | switch (check_type) { |
31 | #ifdef CONFIG_UBSAN_BOUNDS |
32 | /* |
33 | * SanitizerKind::ArrayBounds and SanitizerKind::LocalBounds |
34 | * emit SanitizerHandler::OutOfBounds. |
35 | */ |
36 | case ubsan_out_of_bounds: |
37 | return "UBSAN: array index out of bounds" ; |
38 | #endif |
39 | #ifdef CONFIG_UBSAN_SHIFT |
40 | /* |
41 | * SanitizerKind::ShiftBase and SanitizerKind::ShiftExponent |
42 | * emit SanitizerHandler::ShiftOutOfBounds. |
43 | */ |
44 | case ubsan_shift_out_of_bounds: |
45 | return "UBSAN: shift out of bounds" ; |
46 | #endif |
47 | #ifdef CONFIG_UBSAN_DIV_ZERO |
48 | /* |
49 | * SanitizerKind::IntegerDivideByZero emits |
50 | * SanitizerHandler::DivremOverflow. |
51 | */ |
52 | case ubsan_divrem_overflow: |
53 | return "UBSAN: divide/remainder overflow" ; |
54 | #endif |
55 | #ifdef CONFIG_UBSAN_UNREACHABLE |
56 | /* |
57 | * SanitizerKind::Unreachable emits |
58 | * SanitizerHandler::BuiltinUnreachable. |
59 | */ |
60 | case ubsan_builtin_unreachable: |
61 | return "UBSAN: unreachable code" ; |
62 | #endif |
63 | #if defined(CONFIG_UBSAN_BOOL) || defined(CONFIG_UBSAN_ENUM) |
64 | /* |
65 | * SanitizerKind::Bool and SanitizerKind::Enum emit |
66 | * SanitizerHandler::LoadInvalidValue. |
67 | */ |
68 | case ubsan_load_invalid_value: |
69 | return "UBSAN: loading invalid value" ; |
70 | #endif |
71 | #ifdef CONFIG_UBSAN_ALIGNMENT |
72 | /* |
73 | * SanitizerKind::Alignment emits SanitizerHandler::TypeMismatch |
74 | * or SanitizerHandler::AlignmentAssumption. |
75 | */ |
76 | case ubsan_alignment_assumption: |
77 | return "UBSAN: alignment assumption" ; |
78 | case ubsan_type_mismatch: |
79 | return "UBSAN: type mismatch" ; |
80 | #endif |
81 | default: |
82 | return "UBSAN: unrecognized failure code" ; |
83 | } |
84 | } |
85 | |
86 | #else |
87 | static const char * const type_check_kinds[] = { |
88 | "load of" , |
89 | "store to" , |
90 | "reference binding to" , |
91 | "member access within" , |
92 | "member call on" , |
93 | "constructor call on" , |
94 | "downcast of" , |
95 | "downcast of" |
96 | }; |
97 | |
98 | #define REPORTED_BIT 31 |
99 | |
100 | #if (BITS_PER_LONG == 64) && defined(__BIG_ENDIAN) |
101 | #define COLUMN_MASK (~(1U << REPORTED_BIT)) |
102 | #define LINE_MASK (~0U) |
103 | #else |
104 | #define COLUMN_MASK (~0U) |
105 | #define LINE_MASK (~(1U << REPORTED_BIT)) |
106 | #endif |
107 | |
108 | #define VALUE_LENGTH 40 |
109 | |
110 | static bool was_reported(struct source_location *location) |
111 | { |
112 | return test_and_set_bit(REPORTED_BIT, addr: &location->reported); |
113 | } |
114 | |
115 | static bool suppress_report(struct source_location *loc) |
116 | { |
117 | return current->in_ubsan || was_reported(location: loc); |
118 | } |
119 | |
120 | static bool type_is_int(struct type_descriptor *type) |
121 | { |
122 | return type->type_kind == type_kind_int; |
123 | } |
124 | |
125 | static bool type_is_signed(struct type_descriptor *type) |
126 | { |
127 | WARN_ON(!type_is_int(type)); |
128 | return type->type_info & 1; |
129 | } |
130 | |
131 | static unsigned type_bit_width(struct type_descriptor *type) |
132 | { |
133 | return 1 << (type->type_info >> 1); |
134 | } |
135 | |
136 | static bool is_inline_int(struct type_descriptor *type) |
137 | { |
138 | unsigned inline_bits = sizeof(unsigned long)*8; |
139 | unsigned bits = type_bit_width(type); |
140 | |
141 | WARN_ON(!type_is_int(type)); |
142 | |
143 | return bits <= inline_bits; |
144 | } |
145 | |
146 | static s_max get_signed_val(struct type_descriptor *type, void *val) |
147 | { |
148 | if (is_inline_int(type)) { |
149 | unsigned = sizeof(s_max)*8 - type_bit_width(type); |
150 | unsigned long ulong_val = (unsigned long)val; |
151 | |
152 | return ((s_max)ulong_val) << extra_bits >> extra_bits; |
153 | } |
154 | |
155 | if (type_bit_width(type) == 64) |
156 | return *(s64 *)val; |
157 | |
158 | return *(s_max *)val; |
159 | } |
160 | |
161 | static bool val_is_negative(struct type_descriptor *type, void *val) |
162 | { |
163 | return type_is_signed(type) && get_signed_val(type, val) < 0; |
164 | } |
165 | |
166 | static u_max get_unsigned_val(struct type_descriptor *type, void *val) |
167 | { |
168 | if (is_inline_int(type)) |
169 | return (unsigned long)val; |
170 | |
171 | if (type_bit_width(type) == 64) |
172 | return *(u64 *)val; |
173 | |
174 | return *(u_max *)val; |
175 | } |
176 | |
177 | static void val_to_string(char *str, size_t size, struct type_descriptor *type, |
178 | void *value) |
179 | { |
180 | if (type_is_int(type)) { |
181 | if (type_bit_width(type) == 128) { |
182 | #if defined(CONFIG_ARCH_SUPPORTS_INT128) |
183 | u_max val = get_unsigned_val(type, val: value); |
184 | |
185 | scnprintf(buf: str, size, fmt: "0x%08x%08x%08x%08x" , |
186 | (u32)(val >> 96), |
187 | (u32)(val >> 64), |
188 | (u32)(val >> 32), |
189 | (u32)(val)); |
190 | #else |
191 | WARN_ON(1); |
192 | #endif |
193 | } else if (type_is_signed(type)) { |
194 | scnprintf(buf: str, size, fmt: "%lld" , |
195 | (s64)get_signed_val(type, val: value)); |
196 | } else { |
197 | scnprintf(buf: str, size, fmt: "%llu" , |
198 | (u64)get_unsigned_val(type, val: value)); |
199 | } |
200 | } |
201 | } |
202 | |
203 | static void ubsan_prologue(struct source_location *loc, const char *reason) |
204 | { |
205 | current->in_ubsan++; |
206 | |
207 | pr_err("========================================" |
208 | "========================================\n" ); |
209 | pr_err("UBSAN: %s in %s:%d:%d\n" , reason, loc->file_name, |
210 | loc->line & LINE_MASK, loc->column & COLUMN_MASK); |
211 | |
212 | kunit_fail_current_test("%s in %s" , reason, loc->file_name); |
213 | } |
214 | |
215 | static void ubsan_epilogue(void) |
216 | { |
217 | dump_stack(); |
218 | pr_err("========================================" |
219 | "========================================\n" ); |
220 | |
221 | current->in_ubsan--; |
222 | |
223 | check_panic_on_warn(origin: "UBSAN" ); |
224 | } |
225 | |
226 | void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs) |
227 | { |
228 | struct overflow_data *data = _data; |
229 | char rhs_val_str[VALUE_LENGTH]; |
230 | |
231 | if (suppress_report(loc: &data->location)) |
232 | return; |
233 | |
234 | ubsan_prologue(loc: &data->location, reason: "division-overflow" ); |
235 | |
236 | val_to_string(str: rhs_val_str, size: sizeof(rhs_val_str), type: data->type, value: rhs); |
237 | |
238 | if (type_is_signed(type: data->type) && get_signed_val(type: data->type, val: rhs) == -1) |
239 | pr_err("division of %s by -1 cannot be represented in type %s\n" , |
240 | rhs_val_str, data->type->type_name); |
241 | else |
242 | pr_err("division by zero\n" ); |
243 | |
244 | ubsan_epilogue(); |
245 | } |
246 | EXPORT_SYMBOL(__ubsan_handle_divrem_overflow); |
247 | |
248 | static void handle_null_ptr_deref(struct type_mismatch_data_common *data) |
249 | { |
250 | if (suppress_report(loc: data->location)) |
251 | return; |
252 | |
253 | ubsan_prologue(loc: data->location, reason: "null-ptr-deref" ); |
254 | |
255 | pr_err("%s null pointer of type %s\n" , |
256 | type_check_kinds[data->type_check_kind], |
257 | data->type->type_name); |
258 | |
259 | ubsan_epilogue(); |
260 | } |
261 | |
262 | static void handle_misaligned_access(struct type_mismatch_data_common *data, |
263 | unsigned long ptr) |
264 | { |
265 | if (suppress_report(loc: data->location)) |
266 | return; |
267 | |
268 | ubsan_prologue(loc: data->location, reason: "misaligned-access" ); |
269 | |
270 | pr_err("%s misaligned address %p for type %s\n" , |
271 | type_check_kinds[data->type_check_kind], |
272 | (void *)ptr, data->type->type_name); |
273 | pr_err("which requires %ld byte alignment\n" , data->alignment); |
274 | |
275 | ubsan_epilogue(); |
276 | } |
277 | |
278 | static void handle_object_size_mismatch(struct type_mismatch_data_common *data, |
279 | unsigned long ptr) |
280 | { |
281 | if (suppress_report(loc: data->location)) |
282 | return; |
283 | |
284 | ubsan_prologue(loc: data->location, reason: "object-size-mismatch" ); |
285 | pr_err("%s address %p with insufficient space\n" , |
286 | type_check_kinds[data->type_check_kind], |
287 | (void *) ptr); |
288 | pr_err("for an object of type %s\n" , data->type->type_name); |
289 | ubsan_epilogue(); |
290 | } |
291 | |
292 | static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data, |
293 | unsigned long ptr) |
294 | { |
295 | unsigned long flags = user_access_save(); |
296 | |
297 | if (!ptr) |
298 | handle_null_ptr_deref(data); |
299 | else if (data->alignment && !IS_ALIGNED(ptr, data->alignment)) |
300 | handle_misaligned_access(data, ptr); |
301 | else |
302 | handle_object_size_mismatch(data, ptr); |
303 | |
304 | user_access_restore(flags); |
305 | } |
306 | |
307 | void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, |
308 | void *ptr) |
309 | { |
310 | struct type_mismatch_data_common common_data = { |
311 | .location = &data->location, |
312 | .type = data->type, |
313 | .alignment = data->alignment, |
314 | .type_check_kind = data->type_check_kind |
315 | }; |
316 | |
317 | ubsan_type_mismatch_common(data: &common_data, ptr: (unsigned long)ptr); |
318 | } |
319 | EXPORT_SYMBOL(__ubsan_handle_type_mismatch); |
320 | |
321 | void __ubsan_handle_type_mismatch_v1(void *_data, void *ptr) |
322 | { |
323 | struct type_mismatch_data_v1 *data = _data; |
324 | struct type_mismatch_data_common common_data = { |
325 | .location = &data->location, |
326 | .type = data->type, |
327 | .alignment = 1UL << data->log_alignment, |
328 | .type_check_kind = data->type_check_kind |
329 | }; |
330 | |
331 | ubsan_type_mismatch_common(data: &common_data, ptr: (unsigned long)ptr); |
332 | } |
333 | EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1); |
334 | |
335 | void __ubsan_handle_out_of_bounds(void *_data, void *index) |
336 | { |
337 | struct out_of_bounds_data *data = _data; |
338 | char index_str[VALUE_LENGTH]; |
339 | |
340 | if (suppress_report(loc: &data->location)) |
341 | return; |
342 | |
343 | ubsan_prologue(loc: &data->location, reason: "array-index-out-of-bounds" ); |
344 | |
345 | val_to_string(str: index_str, size: sizeof(index_str), type: data->index_type, value: index); |
346 | pr_err("index %s is out of range for type %s\n" , index_str, |
347 | data->array_type->type_name); |
348 | ubsan_epilogue(); |
349 | } |
350 | EXPORT_SYMBOL(__ubsan_handle_out_of_bounds); |
351 | |
352 | void __ubsan_handle_shift_out_of_bounds(void *_data, void *lhs, void *rhs) |
353 | { |
354 | struct shift_out_of_bounds_data *data = _data; |
355 | struct type_descriptor *rhs_type = data->rhs_type; |
356 | struct type_descriptor *lhs_type = data->lhs_type; |
357 | char rhs_str[VALUE_LENGTH]; |
358 | char lhs_str[VALUE_LENGTH]; |
359 | unsigned long ua_flags = user_access_save(); |
360 | |
361 | if (suppress_report(loc: &data->location)) |
362 | goto out; |
363 | |
364 | ubsan_prologue(loc: &data->location, reason: "shift-out-of-bounds" ); |
365 | |
366 | val_to_string(str: rhs_str, size: sizeof(rhs_str), type: rhs_type, value: rhs); |
367 | val_to_string(str: lhs_str, size: sizeof(lhs_str), type: lhs_type, value: lhs); |
368 | |
369 | if (val_is_negative(type: rhs_type, val: rhs)) |
370 | pr_err("shift exponent %s is negative\n" , rhs_str); |
371 | |
372 | else if (get_unsigned_val(type: rhs_type, val: rhs) >= |
373 | type_bit_width(type: lhs_type)) |
374 | pr_err("shift exponent %s is too large for %u-bit type %s\n" , |
375 | rhs_str, |
376 | type_bit_width(lhs_type), |
377 | lhs_type->type_name); |
378 | else if (val_is_negative(type: lhs_type, val: lhs)) |
379 | pr_err("left shift of negative value %s\n" , |
380 | lhs_str); |
381 | else |
382 | pr_err("left shift of %s by %s places cannot be" |
383 | " represented in type %s\n" , |
384 | lhs_str, rhs_str, |
385 | lhs_type->type_name); |
386 | |
387 | ubsan_epilogue(); |
388 | out: |
389 | user_access_restore(ua_flags); |
390 | } |
391 | EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); |
392 | |
393 | |
394 | void __ubsan_handle_builtin_unreachable(void *_data) |
395 | { |
396 | struct unreachable_data *data = _data; |
397 | ubsan_prologue(loc: &data->location, reason: "unreachable" ); |
398 | pr_err("calling __builtin_unreachable()\n" ); |
399 | ubsan_epilogue(); |
400 | panic(fmt: "can't return from __builtin_unreachable()" ); |
401 | } |
402 | EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable); |
403 | |
404 | void __ubsan_handle_load_invalid_value(void *_data, void *val) |
405 | { |
406 | struct invalid_value_data *data = _data; |
407 | char val_str[VALUE_LENGTH]; |
408 | unsigned long ua_flags = user_access_save(); |
409 | |
410 | if (suppress_report(loc: &data->location)) |
411 | goto out; |
412 | |
413 | ubsan_prologue(loc: &data->location, reason: "invalid-load" ); |
414 | |
415 | val_to_string(str: val_str, size: sizeof(val_str), type: data->type, value: val); |
416 | |
417 | pr_err("load of value %s is not a valid value for type %s\n" , |
418 | val_str, data->type->type_name); |
419 | |
420 | ubsan_epilogue(); |
421 | out: |
422 | user_access_restore(ua_flags); |
423 | } |
424 | EXPORT_SYMBOL(__ubsan_handle_load_invalid_value); |
425 | |
426 | void __ubsan_handle_alignment_assumption(void *_data, unsigned long ptr, |
427 | unsigned long align, |
428 | unsigned long offset) |
429 | { |
430 | struct alignment_assumption_data *data = _data; |
431 | unsigned long real_ptr; |
432 | |
433 | if (suppress_report(loc: &data->location)) |
434 | return; |
435 | |
436 | ubsan_prologue(loc: &data->location, reason: "alignment-assumption" ); |
437 | |
438 | if (offset) |
439 | pr_err("assumption of %lu byte alignment (with offset of %lu byte) for pointer of type %s failed" , |
440 | align, offset, data->type->type_name); |
441 | else |
442 | pr_err("assumption of %lu byte alignment for pointer of type %s failed" , |
443 | align, data->type->type_name); |
444 | |
445 | real_ptr = ptr - offset; |
446 | pr_err("%saddress is %lu aligned, misalignment offset is %lu bytes" , |
447 | offset ? "offset " : "" , BIT(real_ptr ? __ffs(real_ptr) : 0), |
448 | real_ptr & (align - 1)); |
449 | |
450 | ubsan_epilogue(); |
451 | } |
452 | EXPORT_SYMBOL(__ubsan_handle_alignment_assumption); |
453 | |
454 | #endif /* !CONFIG_UBSAN_TRAP */ |
455 | |