1 /* SPDX-License-Identifier: GPL-2.0 */
6 #include <linux/kasan-enabled.h>
7 #include <linux/kasan-tags.h>
8 #include <linux/kernel.h>
9 #include <linux/static_key.h>
10 #include <linux/types.h>
20 #include <linux/linkage.h>
21 #include <asm/kasan.h>
25 typedef unsigned int __bitwise kasan_vmalloc_flags_t
;
27 #define KASAN_VMALLOC_NONE ((__force kasan_vmalloc_flags_t)0x00u)
28 #define KASAN_VMALLOC_INIT ((__force kasan_vmalloc_flags_t)0x01u)
29 #define KASAN_VMALLOC_VM_ALLOC ((__force kasan_vmalloc_flags_t)0x02u)
30 #define KASAN_VMALLOC_PROT_NORMAL ((__force kasan_vmalloc_flags_t)0x04u)
32 #define KASAN_VMALLOC_PAGE_RANGE 0x1 /* Apply exsiting page range */
33 #define KASAN_VMALLOC_TLB_FLUSH 0x2 /* TLB flush */
35 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
37 #include <linux/pgtable.h>
39 /* Software KASAN implementations use shadow memory. */
41 #ifdef CONFIG_KASAN_SW_TAGS
42 /* This matches KASAN_TAG_INVALID. */
43 #define KASAN_SHADOW_INIT 0xFE
45 #define KASAN_SHADOW_INIT 0
48 #ifndef PTE_HWTABLE_PTRS
49 #define PTE_HWTABLE_PTRS 0
52 extern unsigned char kasan_early_shadow_page
[PAGE_SIZE
];
53 extern pte_t kasan_early_shadow_pte
[MAX_PTRS_PER_PTE
+ PTE_HWTABLE_PTRS
];
54 extern pmd_t kasan_early_shadow_pmd
[MAX_PTRS_PER_PMD
];
55 extern pud_t kasan_early_shadow_pud
[MAX_PTRS_PER_PUD
];
56 extern p4d_t kasan_early_shadow_p4d
[MAX_PTRS_PER_P4D
];
58 int kasan_populate_early_shadow(const void *shadow_start
,
59 const void *shadow_end
);
61 #ifndef kasan_mem_to_shadow
62 static inline void *kasan_mem_to_shadow(const void *addr
)
64 return (void *)((unsigned long)addr
>> KASAN_SHADOW_SCALE_SHIFT
)
65 + KASAN_SHADOW_OFFSET
;
69 int kasan_add_zero_shadow(void *start
, unsigned long size
);
70 void kasan_remove_zero_shadow(void *start
, unsigned long size
);
72 /* Enable reporting bugs after kasan_disable_current() */
73 extern void kasan_enable_current(void);
75 /* Disable reporting bugs for current task */
76 extern void kasan_disable_current(void);
78 #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
80 static inline int kasan_add_zero_shadow(void *start
, unsigned long size
)
84 static inline void kasan_remove_zero_shadow(void *start
,
88 static inline void kasan_enable_current(void) {}
89 static inline void kasan_disable_current(void) {}
91 #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
93 #ifdef CONFIG_KASAN_HW_TAGS
95 #else /* CONFIG_KASAN_HW_TAGS */
97 #endif /* CONFIG_KASAN_HW_TAGS */
99 static inline bool kasan_has_integrated_init(void)
101 return kasan_hw_tags_enabled();
105 void __kasan_unpoison_range(const void *addr
, size_t size
);
106 static __always_inline
void kasan_unpoison_range(const void *addr
, size_t size
)
109 __kasan_unpoison_range(addr
, size
);
112 void __kasan_poison_pages(struct page
*page
, unsigned int order
, bool init
);
113 static __always_inline
void kasan_poison_pages(struct page
*page
,
114 unsigned int order
, bool init
)
117 __kasan_poison_pages(page
, order
, init
);
120 bool __kasan_unpoison_pages(struct page
*page
, unsigned int order
, bool init
);
121 static __always_inline
bool kasan_unpoison_pages(struct page
*page
,
122 unsigned int order
, bool init
)
125 return __kasan_unpoison_pages(page
, order
, init
);
129 void __kasan_poison_slab(struct slab
*slab
);
130 static __always_inline
void kasan_poison_slab(struct slab
*slab
)
133 __kasan_poison_slab(slab
);
136 void __kasan_unpoison_new_object(struct kmem_cache
*cache
, void *object
);
138 * kasan_unpoison_new_object - Temporarily unpoison a new slab object.
139 * @cache: Cache the object belong to.
140 * @object: Pointer to the object.
142 * This function is intended for the slab allocator's internal use. It
143 * temporarily unpoisons an object from a newly allocated slab without doing
144 * anything else. The object must later be repoisoned by
145 * kasan_poison_new_object().
147 static __always_inline
void kasan_unpoison_new_object(struct kmem_cache
*cache
,
151 __kasan_unpoison_new_object(cache
, object
);
154 void __kasan_poison_new_object(struct kmem_cache
*cache
, void *object
);
156 * kasan_unpoison_new_object - Repoison a new slab object.
157 * @cache: Cache the object belong to.
158 * @object: Pointer to the object.
160 * This function is intended for the slab allocator's internal use. It
161 * repoisons an object that was previously unpoisoned by
162 * kasan_unpoison_new_object() without doing anything else.
164 static __always_inline
void kasan_poison_new_object(struct kmem_cache
*cache
,
168 __kasan_poison_new_object(cache
, object
);
171 void * __must_check
__kasan_init_slab_obj(struct kmem_cache
*cache
,
173 static __always_inline
void * __must_check
kasan_init_slab_obj(
174 struct kmem_cache
*cache
, const void *object
)
177 return __kasan_init_slab_obj(cache
, object
);
178 return (void *)object
;
181 bool __kasan_slab_pre_free(struct kmem_cache
*s
, void *object
,
184 * kasan_slab_pre_free - Check whether freeing a slab object is safe.
185 * @object: Object to be freed.
187 * This function checks whether freeing the given object is safe. It may
188 * check for double-free and invalid-free bugs and report them.
190 * This function is intended only for use by the slab allocator.
192 * @Return true if freeing the object is unsafe; false otherwise.
194 static __always_inline
bool kasan_slab_pre_free(struct kmem_cache
*s
,
198 return __kasan_slab_pre_free(s
, object
, _RET_IP_
);
202 bool __kasan_slab_free(struct kmem_cache
*s
, void *object
, bool init
,
203 bool still_accessible
);
205 * kasan_slab_free - Poison, initialize, and quarantine a slab object.
206 * @object: Object to be freed.
207 * @init: Whether to initialize the object.
208 * @still_accessible: Whether the object contents are still accessible.
210 * This function informs that a slab object has been freed and is not
211 * supposed to be accessed anymore, except when @still_accessible is set
212 * (indicating that the object is in a SLAB_TYPESAFE_BY_RCU cache and an RCU
213 * grace period might not have passed yet).
215 * For KASAN modes that have integrated memory initialization
216 * (kasan_has_integrated_init() == true), this function also initializes
217 * the object's memory. For other modes, the @init argument is ignored.
219 * This function might also take ownership of the object to quarantine it.
220 * When this happens, KASAN will defer freeing the object to a later
221 * stage and handle it internally until then. The return value indicates
222 * whether KASAN took ownership of the object.
224 * This function is intended only for use by the slab allocator.
226 * @Return true if KASAN took ownership of the object; false otherwise.
228 static __always_inline
bool kasan_slab_free(struct kmem_cache
*s
,
229 void *object
, bool init
,
230 bool still_accessible
)
233 return __kasan_slab_free(s
, object
, init
, still_accessible
);
237 void __kasan_kfree_large(void *ptr
, unsigned long ip
);
238 static __always_inline
void kasan_kfree_large(void *ptr
)
241 __kasan_kfree_large(ptr
, _RET_IP_
);
244 void * __must_check
__kasan_slab_alloc(struct kmem_cache
*s
,
245 void *object
, gfp_t flags
, bool init
);
246 static __always_inline
void * __must_check
kasan_slab_alloc(
247 struct kmem_cache
*s
, void *object
, gfp_t flags
, bool init
)
250 return __kasan_slab_alloc(s
, object
, flags
, init
);
254 void * __must_check
__kasan_kmalloc(struct kmem_cache
*s
, const void *object
,
255 size_t size
, gfp_t flags
);
256 static __always_inline
void * __must_check
kasan_kmalloc(struct kmem_cache
*s
,
257 const void *object
, size_t size
, gfp_t flags
)
260 return __kasan_kmalloc(s
, object
, size
, flags
);
261 return (void *)object
;
264 void * __must_check
__kasan_kmalloc_large(const void *ptr
,
265 size_t size
, gfp_t flags
);
266 static __always_inline
void * __must_check
kasan_kmalloc_large(const void *ptr
,
267 size_t size
, gfp_t flags
)
270 return __kasan_kmalloc_large(ptr
, size
, flags
);
274 void * __must_check
__kasan_krealloc(const void *object
,
275 size_t new_size
, gfp_t flags
);
276 static __always_inline
void * __must_check
kasan_krealloc(const void *object
,
277 size_t new_size
, gfp_t flags
)
280 return __kasan_krealloc(object
, new_size
, flags
);
281 return (void *)object
;
284 bool __kasan_mempool_poison_pages(struct page
*page
, unsigned int order
,
287 * kasan_mempool_poison_pages - Check and poison a mempool page allocation.
288 * @page: Pointer to the page allocation.
289 * @order: Order of the allocation.
291 * This function is intended for kernel subsystems that cache page allocations
292 * to reuse them instead of freeing them back to page_alloc (e.g. mempool).
294 * This function is similar to kasan_mempool_poison_object() but operates on
297 * Before the poisoned allocation can be reused, it must be unpoisoned via
298 * kasan_mempool_unpoison_pages().
300 * Return: true if the allocation can be safely reused; false otherwise.
302 static __always_inline
bool kasan_mempool_poison_pages(struct page
*page
,
306 return __kasan_mempool_poison_pages(page
, order
, _RET_IP_
);
310 void __kasan_mempool_unpoison_pages(struct page
*page
, unsigned int order
,
313 * kasan_mempool_unpoison_pages - Unpoison a mempool page allocation.
314 * @page: Pointer to the page allocation.
315 * @order: Order of the allocation.
317 * This function is intended for kernel subsystems that cache page allocations
318 * to reuse them instead of freeing them back to page_alloc (e.g. mempool).
320 * This function unpoisons a page allocation that was previously poisoned by
321 * kasan_mempool_poison_pages() without zeroing the allocation's memory. For
322 * the tag-based modes, this function assigns a new tag to the allocation.
324 static __always_inline
void kasan_mempool_unpoison_pages(struct page
*page
,
328 __kasan_mempool_unpoison_pages(page
, order
, _RET_IP_
);
331 bool __kasan_mempool_poison_object(void *ptr
, unsigned long ip
);
333 * kasan_mempool_poison_object - Check and poison a mempool slab allocation.
334 * @ptr: Pointer to the slab allocation.
336 * This function is intended for kernel subsystems that cache slab allocations
337 * to reuse them instead of freeing them back to the slab allocator (e.g.
340 * This function poisons a slab allocation and saves a free stack trace for it
341 * without initializing the allocation's memory and without putting it into the
342 * quarantine (for the Generic mode).
344 * This function also performs checks to detect double-free and invalid-free
345 * bugs and reports them. The caller can use the return value of this function
346 * to find out if the allocation is buggy.
348 * Before the poisoned allocation can be reused, it must be unpoisoned via
349 * kasan_mempool_unpoison_object().
351 * This function operates on all slab allocations including large kmalloc
352 * allocations (the ones returned by kmalloc_large() or by kmalloc() with the
353 * size > KMALLOC_MAX_SIZE).
355 * Return: true if the allocation can be safely reused; false otherwise.
357 static __always_inline
bool kasan_mempool_poison_object(void *ptr
)
360 return __kasan_mempool_poison_object(ptr
, _RET_IP_
);
364 void __kasan_mempool_unpoison_object(void *ptr
, size_t size
, unsigned long ip
);
366 * kasan_mempool_unpoison_object - Unpoison a mempool slab allocation.
367 * @ptr: Pointer to the slab allocation.
368 * @size: Size to be unpoisoned.
370 * This function is intended for kernel subsystems that cache slab allocations
371 * to reuse them instead of freeing them back to the slab allocator (e.g.
374 * This function unpoisons a slab allocation that was previously poisoned via
375 * kasan_mempool_poison_object() and saves an alloc stack trace for it without
376 * initializing the allocation's memory. For the tag-based modes, this function
377 * does not assign a new tag to the allocation and instead restores the
378 * original tags based on the pointer value.
380 * This function operates on all slab allocations including large kmalloc
381 * allocations (the ones returned by kmalloc_large() or by kmalloc() with the
382 * size > KMALLOC_MAX_SIZE).
384 static __always_inline
void kasan_mempool_unpoison_object(void *ptr
,
388 __kasan_mempool_unpoison_object(ptr
, size
, _RET_IP_
);
392 * Unlike kasan_check_read/write(), kasan_check_byte() is performed even for
393 * the hardware tag-based mode that doesn't rely on compiler instrumentation.
395 bool __kasan_check_byte(const void *addr
, unsigned long ip
);
396 static __always_inline
bool kasan_check_byte(const void *addr
)
399 return __kasan_check_byte(addr
, _RET_IP_
);
403 #else /* CONFIG_KASAN */
405 static inline void kasan_unpoison_range(const void *address
, size_t size
) {}
406 static inline void kasan_poison_pages(struct page
*page
, unsigned int order
,
408 static inline bool kasan_unpoison_pages(struct page
*page
, unsigned int order
,
413 static inline void kasan_poison_slab(struct slab
*slab
) {}
414 static inline void kasan_unpoison_new_object(struct kmem_cache
*cache
,
416 static inline void kasan_poison_new_object(struct kmem_cache
*cache
,
418 static inline void *kasan_init_slab_obj(struct kmem_cache
*cache
,
421 return (void *)object
;
424 static inline bool kasan_slab_pre_free(struct kmem_cache
*s
, void *object
)
429 static inline bool kasan_slab_free(struct kmem_cache
*s
, void *object
,
430 bool init
, bool still_accessible
)
434 static inline void kasan_kfree_large(void *ptr
) {}
435 static inline void *kasan_slab_alloc(struct kmem_cache
*s
, void *object
,
436 gfp_t flags
, bool init
)
440 static inline void *kasan_kmalloc(struct kmem_cache
*s
, const void *object
,
441 size_t size
, gfp_t flags
)
443 return (void *)object
;
445 static inline void *kasan_kmalloc_large(const void *ptr
, size_t size
, gfp_t flags
)
449 static inline void *kasan_krealloc(const void *object
, size_t new_size
,
452 return (void *)object
;
454 static inline bool kasan_mempool_poison_pages(struct page
*page
, unsigned int order
)
458 static inline void kasan_mempool_unpoison_pages(struct page
*page
, unsigned int order
) {}
459 static inline bool kasan_mempool_poison_object(void *ptr
)
463 static inline void kasan_mempool_unpoison_object(void *ptr
, size_t size
) {}
465 static inline bool kasan_check_byte(const void *address
)
470 #endif /* CONFIG_KASAN */
472 #if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK)
473 void kasan_unpoison_task_stack(struct task_struct
*task
);
474 asmlinkage
void kasan_unpoison_task_stack_below(const void *watermark
);
476 static inline void kasan_unpoison_task_stack(struct task_struct
*task
) {}
477 static inline void kasan_unpoison_task_stack_below(const void *watermark
) {}
480 #ifdef CONFIG_KASAN_GENERIC
483 int alloc_meta_offset
;
484 int free_meta_offset
;
487 size_t kasan_metadata_size(struct kmem_cache
*cache
, bool in_object
);
488 void kasan_cache_create(struct kmem_cache
*cache
, unsigned int *size
,
489 slab_flags_t
*flags
);
491 void kasan_cache_shrink(struct kmem_cache
*cache
);
492 void kasan_cache_shutdown(struct kmem_cache
*cache
);
493 void kasan_record_aux_stack(void *ptr
);
494 void kasan_record_aux_stack_noalloc(void *ptr
);
496 #else /* CONFIG_KASAN_GENERIC */
498 /* Tag-based KASAN modes do not use per-object metadata. */
499 static inline size_t kasan_metadata_size(struct kmem_cache
*cache
,
504 /* And no cache-related metadata initialization is required. */
505 static inline void kasan_cache_create(struct kmem_cache
*cache
,
507 slab_flags_t
*flags
) {}
509 static inline void kasan_cache_shrink(struct kmem_cache
*cache
) {}
510 static inline void kasan_cache_shutdown(struct kmem_cache
*cache
) {}
511 static inline void kasan_record_aux_stack(void *ptr
) {}
512 static inline void kasan_record_aux_stack_noalloc(void *ptr
) {}
514 #endif /* CONFIG_KASAN_GENERIC */
516 #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)
518 static inline void *kasan_reset_tag(const void *addr
)
520 return (void *)arch_kasan_reset_tag(addr
);
524 * kasan_report - print a report about a bad memory access detected by KASAN
525 * @addr: address of the bad access
526 * @size: size of the bad access
527 * @is_write: whether the bad access is a write or a read
528 * @ip: instruction pointer for the accessibility check or the bad access itself
530 bool kasan_report(const void *addr
, size_t size
,
531 bool is_write
, unsigned long ip
);
533 #else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */
535 static inline void *kasan_reset_tag(const void *addr
)
540 #endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/
542 #ifdef CONFIG_KASAN_HW_TAGS
544 void kasan_report_async(void);
546 #endif /* CONFIG_KASAN_HW_TAGS */
548 #ifdef CONFIG_KASAN_SW_TAGS
549 void __init
kasan_init_sw_tags(void);
551 static inline void kasan_init_sw_tags(void) { }
554 #ifdef CONFIG_KASAN_HW_TAGS
555 void kasan_init_hw_tags_cpu(void);
556 void __init
kasan_init_hw_tags(void);
558 static inline void kasan_init_hw_tags_cpu(void) { }
559 static inline void kasan_init_hw_tags(void) { }
562 #ifdef CONFIG_KASAN_VMALLOC
564 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
566 void kasan_populate_early_vm_area_shadow(void *start
, unsigned long size
);
567 int kasan_populate_vmalloc(unsigned long addr
, unsigned long size
);
568 void kasan_release_vmalloc(unsigned long start
, unsigned long end
,
569 unsigned long free_region_start
,
570 unsigned long free_region_end
,
571 unsigned long flags
);
573 #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
575 static inline void kasan_populate_early_vm_area_shadow(void *start
,
578 static inline int kasan_populate_vmalloc(unsigned long start
,
583 static inline void kasan_release_vmalloc(unsigned long start
,
585 unsigned long free_region_start
,
586 unsigned long free_region_end
,
587 unsigned long flags
) { }
589 #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
591 void *__kasan_unpoison_vmalloc(const void *start
, unsigned long size
,
592 kasan_vmalloc_flags_t flags
);
593 static __always_inline
void *kasan_unpoison_vmalloc(const void *start
,
595 kasan_vmalloc_flags_t flags
)
598 return __kasan_unpoison_vmalloc(start
, size
, flags
);
599 return (void *)start
;
602 void __kasan_poison_vmalloc(const void *start
, unsigned long size
);
603 static __always_inline
void kasan_poison_vmalloc(const void *start
,
607 __kasan_poison_vmalloc(start
, size
);
610 #else /* CONFIG_KASAN_VMALLOC */
612 static inline void kasan_populate_early_vm_area_shadow(void *start
,
613 unsigned long size
) { }
614 static inline int kasan_populate_vmalloc(unsigned long start
,
619 static inline void kasan_release_vmalloc(unsigned long start
,
621 unsigned long free_region_start
,
622 unsigned long free_region_end
,
623 unsigned long flags
) { }
625 static inline void *kasan_unpoison_vmalloc(const void *start
,
627 kasan_vmalloc_flags_t flags
)
629 return (void *)start
;
631 static inline void kasan_poison_vmalloc(const void *start
, unsigned long size
)
634 #endif /* CONFIG_KASAN_VMALLOC */
636 #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \
637 !defined(CONFIG_KASAN_VMALLOC)
640 * These functions allocate and free shadow memory for kernel modules.
641 * They are only required when KASAN_VMALLOC is not supported, as otherwise
642 * shadow memory is allocated by the generic vmalloc handlers.
644 int kasan_alloc_module_shadow(void *addr
, size_t size
, gfp_t gfp_mask
);
645 void kasan_free_module_shadow(const struct vm_struct
*vm
);
647 #else /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */
649 static inline int kasan_alloc_module_shadow(void *addr
, size_t size
, gfp_t gfp_mask
) { return 0; }
650 static inline void kasan_free_module_shadow(const struct vm_struct
*vm
) {}
652 #endif /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */
654 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
655 void kasan_non_canonical_hook(unsigned long addr
);
656 #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
657 static inline void kasan_non_canonical_hook(unsigned long addr
) { }
658 #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
660 #endif /* LINUX_KASAN_H */