lib/ubsan.c

   1 /*
   2  * UBSAN error reporting functions
   3  *
   4  * Copyright (c) 2014 Samsung Electronics Co., Ltd.
   5  * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  */
  12
  13 #include <linux/bitops.h>
  14 #include <linux/bug.h>
  15 #include <linux/ctype.h>
  16 #include <linux/init.h>
  17 #include <linux/kernel.h>
  18 #include <linux/types.h>
  19 #include <linux/sched.h>
  20
  21 #include "ubsan.h"
  22
  23 const char *type_check_kinds[] = {
  24         "load of",
  25         "store to",
  26         "reference binding to",
  27         "member access within",
  28         "member call on",
  29         "constructor call on",
  30         "downcast of",
  31         "downcast of"
  32 };
  33
  34 #define REPORTED_BIT 31
  35
  36 #if (BITS_PER_LONG == 64) && defined(__BIG_ENDIAN)
  37 #define COLUMN_MASK (~(1U << REPORTED_BIT))
  38 #define LINE_MASK   (~0U)
  39 #else
  40 #define COLUMN_MASK   (~0U)
  41 #define LINE_MASK (~(1U << REPORTED_BIT))
  42 #endif
  43
  44 #define VALUE_LENGTH 40
  45
  46 static bool was_reported(struct source_location *location)
  47 {
  48         return test_and_set_bit(REPORTED_BIT, &location->reported);
  49 }
  50
  51 static void print_source_location(const char *prefix,
  52                                 struct source_location *loc)
  53 {
  54         pr_err("%s %s:%d:%d\n", prefix, loc->file_name,
  55                 loc->line & LINE_MASK, loc->column & COLUMN_MASK);
  56 }
  57
  58 static bool suppress_report(struct source_location *loc)
  59 {
  60         return current->in_ubsan || was_reported(loc);
  61 }
  62
  63 static bool type_is_int(struct type_descriptor *type)
  64 {
  65         return type->type_kind == type_kind_int;
  66 }
  67
  68 static bool type_is_signed(struct type_descriptor *type)
  69 {
  70         WARN_ON(!type_is_int(type));
  71         return  type->type_info & 1;
  72 }
  73
  74 static unsigned type_bit_width(struct type_descriptor *type)
  75 {
  76         return 1 << (type->type_info >> 1);
  77 }
  78
  79 static bool is_inline_int(struct type_descriptor *type)
  80 {
  81         unsigned inline_bits = sizeof(unsigned long)*8;
  82         unsigned bits = type_bit_width(type);
  83
  84         WARN_ON(!type_is_int(type));
  85
  86         return bits <= inline_bits;
  87 }
  88
  89 static s_max get_signed_val(struct type_descriptor *type, void *val)
  90 {
  91         if (is_inline_int(type)) {
  92                 unsigned extra_bits = sizeof(s_max)*8 - type_bit_width(type);
  93                 unsigned long ulong_val = (unsigned long)val;
  94
  95                 return ((s_max)ulong_val) << extra_bits >> extra_bits;
  96         }
  97
  98         if (type_bit_width(type) == 64)
  99                 return *(s64 *)val;
 100
 101         return *(s_max *)val;
 102 }
 103
 104 static bool val_is_negative(struct type_descriptor *type, void *val)
 105 {
 106         return type_is_signed(type) && get_signed_val(type, val) < 0;
 107 }
 108
 109 static u_max get_unsigned_val(struct type_descriptor *type, void *val)
 110 {
 111         if (is_inline_int(type))
 112                 return (unsigned long)val;
 113
 114         if (type_bit_width(type) == 64)
 115                 return *(u64 *)val;
 116
 117         return *(u_max *)val;
 118 }
 119
 120 static void val_to_string(char *str, size_t size, struct type_descriptor *type,
 121                         void *value)
 122 {
 123         if (type_is_int(type)) {
 124                 if (type_bit_width(type) == 128) {
 125 #if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
 126                         u_max val = get_unsigned_val(type, value);
 127
 128                         scnprintf(str, size, "0x%08x%08x%08x%08x",
 129                                 (u32)(val >> 96),
 130                                 (u32)(val >> 64),
 131                                 (u32)(val >> 32),
 132                                 (u32)(val));
 133 #else
 134                         WARN_ON(1);
 135 #endif
 136                 } else if (type_is_signed(type)) {
 137                         scnprintf(str, size, "%lld",
 138                                 (s64)get_signed_val(type, value));
 139                 } else {
 140                         scnprintf(str, size, "%llu",
 141                                 (u64)get_unsigned_val(type, value));
 142                 }
 143         }
 144 }
 145
 146 static bool location_is_valid(struct source_location *loc)
 147 {
 148         return loc->file_name != NULL;
 149 }
 150
 151 static DEFINE_SPINLOCK(report_lock);
 152
 153 static void ubsan_prologue(struct source_location *location,
 154                         unsigned long *flags)
 155 {
 156         current->in_ubsan++;
 157         spin_lock_irqsave(&report_lock, *flags);
 158
 159         pr_err("========================================"
 160                 "========================================\n");
 161         print_source_location("UBSAN: Undefined behaviour in", location);
 162 }
 163
 164 static void ubsan_epilogue(unsigned long *flags)
 165 {
 166         dump_stack();
 167         pr_err("========================================"
 168                 "========================================\n");
 169         spin_unlock_irqrestore(&report_lock, *flags);
 170         current->in_ubsan--;
 171 }
 172
 173 static void handle_overflow(struct overflow_data *data, void *lhs,
 174                         void *rhs, char op)
 175 {
 176
 177         struct type_descriptor *type = data->type;
 178         unsigned long flags;
 179         char lhs_val_str[VALUE_LENGTH];
 180         char rhs_val_str[VALUE_LENGTH];
 181
 182         if (suppress_report(&data->location))
 183                 return;
 184
 185         ubsan_prologue(&data->location, &flags);
 186
 187         val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);
 188         val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);
 189         pr_err("%s integer overflow:\n",
 190                 type_is_signed(type) ? "signed" : "unsigned");
 191         pr_err("%s %c %s cannot be represented in type %s\n",
 192                 lhs_val_str,
 193                 op,
 194                 rhs_val_str,
 195                 type->type_name);
 196
 197         ubsan_epilogue(&flags);
 198 }
 199
 200 void __ubsan_handle_add_overflow(struct overflow_data *data,
 201                                 void *lhs, void *rhs)
 202 {
 203
 204         handle_overflow(data, lhs, rhs, '+');
 205 }
 206 EXPORT_SYMBOL(__ubsan_handle_add_overflow);
 207
 208 void __ubsan_handle_sub_overflow(struct overflow_data *data,
 209                                 void *lhs, void *rhs)
 210 {
 211         handle_overflow(data, lhs, rhs, '-');
 212 }
 213 EXPORT_SYMBOL(__ubsan_handle_sub_overflow);
 214
 215 void __ubsan_handle_mul_overflow(struct overflow_data *data,
 216                                 void *lhs, void *rhs)
 217 {
 218         handle_overflow(data, lhs, rhs, '*');
 219 }
 220 EXPORT_SYMBOL(__ubsan_handle_mul_overflow);
 221
 222 void __ubsan_handle_negate_overflow(struct overflow_data *data,
 223                                 void *old_val)
 224 {
 225         unsigned long flags;
 226         char old_val_str[VALUE_LENGTH];
 227
 228         if (suppress_report(&data->location))
 229                 return;
 230
 231         ubsan_prologue(&data->location, &flags);
 232
 233         val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
 234
 235         pr_err("negation of %s cannot be represented in type %s:\n",
 236                 old_val_str, data->type->type_name);
 237
 238         ubsan_epilogue(&flags);
 239 }
 240 EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
 241
 242
 243 void __ubsan_handle_divrem_overflow(struct overflow_data *data,
 244                                 void *lhs, void *rhs)
 245 {
 246         unsigned long flags;
 247         char rhs_val_str[VALUE_LENGTH];
 248
 249         if (suppress_report(&data->location))
 250                 return;
 251
 252         ubsan_prologue(&data->location, &flags);
 253
 254         val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
 255
 256         if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1)
 257                 pr_err("division of %s by -1 cannot be represented in type %s\n",
 258                         rhs_val_str, data->type->type_name);
 259         else
 260                 pr_err("division by zero\n");
 261
 262         ubsan_epilogue(&flags);
 263 }
 264 EXPORT_SYMBOL(__ubsan_handle_divrem_overflow);
 265
 266 static void handle_null_ptr_deref(struct type_mismatch_data_common *data)
 267 {
 268         unsigned long flags;
 269
 270         if (suppress_report(data->location))
 271                 return;
 272
 273         ubsan_prologue(data->location, &flags);
 274
 275         pr_err("%s null pointer of type %s\n",
 276                 type_check_kinds[data->type_check_kind],
 277                 data->type->type_name);
 278
 279         ubsan_epilogue(&flags);
 280 }
 281
 282 static void handle_misaligned_access(struct type_mismatch_data_common *data,
 283                                 unsigned long ptr)
 284 {
 285         unsigned long flags;
 286
 287         if (suppress_report(data->location))
 288                 return;
 289
 290         ubsan_prologue(data->location, &flags);
 291
 292         pr_err("%s misaligned address %p for type %s\n",
 293                 type_check_kinds[data->type_check_kind],
 294                 (void *)ptr, data->type->type_name);
 295         pr_err("which requires %ld byte alignment\n", data->alignment);
 296
 297         ubsan_epilogue(&flags);
 298 }
 299
 300 static void handle_object_size_mismatch(struct type_mismatch_data_common *data,
 301                                         unsigned long ptr)
 302 {
 303         unsigned long flags;
 304
 305         if (suppress_report(data->location))
 306                 return;
 307
 308         ubsan_prologue(data->location, &flags);
 309         pr_err("%s address %p with insufficient space\n",
 310                 type_check_kinds[data->type_check_kind],
 311                 (void *) ptr);
 312         pr_err("for an object of type %s\n", data->type->type_name);
 313         ubsan_epilogue(&flags);
 314 }
 315
 316 static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data,
 317                                 unsigned long ptr)
 318 {
 319
 320         if (!ptr)
 321                 handle_null_ptr_deref(data);
 322         else if (data->alignment && !IS_ALIGNED(ptr, data->alignment))
 323                 handle_misaligned_access(data, ptr);
 324         else
 325                 handle_object_size_mismatch(data, ptr);
 326 }
 327
 328 void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
 329                                 void *ptr)
 330 {
 331         struct type_mismatch_data_common common_data = {
 332                 .location = &data->location,
 333                 .type = data->type,
 334                 .alignment = data->alignment,
 335                 .type_check_kind = data->type_check_kind
 336         };
 337
 338         ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
 339 }
 340 EXPORT_SYMBOL(__ubsan_handle_type_mismatch);
 341
 342 void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data,
 343                                 void *ptr)
 344 {
 345
 346         struct type_mismatch_data_common common_data = {
 347                 .location = &data->location,
 348                 .type = data->type,
 349                 .alignment = 1UL << data->log_alignment,
 350                 .type_check_kind = data->type_check_kind
 351         };
 352
 353         ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
 354 }
 355 EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1);
 356
 357 void __ubsan_handle_nonnull_return(struct nonnull_return_data *data)
 358 {
 359         unsigned long flags;
 360
 361         if (suppress_report(&data->location))
 362                 return;
 363
 364         ubsan_prologue(&data->location, &flags);
 365
 366         pr_err("null pointer returned from function declared to never return null\n");
 367
 368         if (location_is_valid(&data->attr_location))
 369                 print_source_location("returns_nonnull attribute specified in",
 370                                 &data->attr_location);
 371
 372         ubsan_epilogue(&flags);
 373 }
 374 EXPORT_SYMBOL(__ubsan_handle_nonnull_return);
 375
 376 void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data,
 377                                         void *bound)
 378 {
 379         unsigned long flags;
 380         char bound_str[VALUE_LENGTH];
 381
 382         if (suppress_report(&data->location))
 383                 return;
 384
 385         ubsan_prologue(&data->location, &flags);
 386
 387         val_to_string(bound_str, sizeof(bound_str), data->type, bound);
 388         pr_err("variable length array bound value %s <= 0\n", bound_str);
 389
 390         ubsan_epilogue(&flags);
 391 }
 392 EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive);
 393
 394 void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index)
 395 {
 396         unsigned long flags;
 397         char index_str[VALUE_LENGTH];
 398
 399         if (suppress_report(&data->location))
 400                 return;
 401
 402         ubsan_prologue(&data->location, &flags);
 403
 404         val_to_string(index_str, sizeof(index_str), data->index_type, index);
 405         pr_err("index %s is out of range for type %s\n", index_str,
 406                 data->array_type->type_name);
 407         ubsan_epilogue(&flags);
 408 }
 409 EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
 410
 411 void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
 412                                         void *lhs, void *rhs)
 413 {
 414         unsigned long flags;
 415         struct type_descriptor *rhs_type = data->rhs_type;
 416         struct type_descriptor *lhs_type = data->lhs_type;
 417         char rhs_str[VALUE_LENGTH];
 418         char lhs_str[VALUE_LENGTH];
 419
 420         if (suppress_report(&data->location))
 421                 return;
 422
 423         ubsan_prologue(&data->location, &flags);
 424
 425         val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
 426         val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
 427
 428         if (val_is_negative(rhs_type, rhs))
 429                 pr_err("shift exponent %s is negative\n", rhs_str);
 430
 431         else if (get_unsigned_val(rhs_type, rhs) >=
 432                 type_bit_width(lhs_type))
 433                 pr_err("shift exponent %s is too large for %u-bit type %s\n",
 434                         rhs_str,
 435                         type_bit_width(lhs_type),
 436                         lhs_type->type_name);
 437         else if (val_is_negative(lhs_type, lhs))
 438                 pr_err("left shift of negative value %s\n",
 439                         lhs_str);
 440         else
 441                 pr_err("left shift of %s by %s places cannot be"
 442                         " represented in type %s\n",
 443                         lhs_str, rhs_str,
 444                         lhs_type->type_name);
 445
 446         ubsan_epilogue(&flags);
 447 }
 448 EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
 449
 450
 451 void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
 452 {
 453         unsigned long flags;
 454
 455         ubsan_prologue(&data->location, &flags);
 456         pr_err("calling __builtin_unreachable()\n");
 457         ubsan_epilogue(&flags);
 458         panic("can't return from __builtin_unreachable()");
 459 }
 460 EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
 461
 462 void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
 463                                 void *val)
 464 {
 465         unsigned long flags;
 466         char val_str[VALUE_LENGTH];
 467
 468         if (suppress_report(&data->location))
 469                 return;
 470
 471         ubsan_prologue(&data->location, &flags);
 472
 473         val_to_string(val_str, sizeof(val_str), data->type, val);
 474
 475         pr_err("load of value %s is not a valid value for type %s\n",
 476                 val_str, data->type->type_name);
 477
 478         ubsan_epilogue(&flags);
 479 }
 480 EXPORT_SYMBOL(__ubsan_handle_load_invalid_value);