lkml.org 
[lkml]   [2017]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 6/9] kasan: improve slab object description
    Date
    Changes slab object description from:

    Object at ffff880068388540, in cache kmalloc-128 size: 128

    to:

    The buggy address belongs to the object at ffff880068388540
    which belongs to the cache kmalloc-128 of size 128
    The buggy address is located 123 bytes inside of
    128-byte region [ffff880068388540, ffff8800683885c0)

    Makes it more explanatory and adds information about relative offset
    of the accessed address to the start of the object.

    Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
    ---
    mm/kasan/report.c | 53 ++++++++++++++++++++++++++++++++++++++++++-----------
    1 file changed, 42 insertions(+), 11 deletions(-)

    diff --git a/mm/kasan/report.c b/mm/kasan/report.c
    index 945d0e13e8a4..8dfb7a060d69 100644
    --- a/mm/kasan/report.c
    +++ b/mm/kasan/report.c
    @@ -196,18 +196,49 @@ static struct page *addr_to_page(const void *addr)
    return NULL;
    }

    -static void describe_object(struct kmem_cache *cache, void *object)
    +static void describe_object_addr(struct kmem_cache *cache, void *object,
    + const void *addr)
    {
    - struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
    + unsigned long access_addr = (unsigned long)addr;
    + unsigned long object_addr = (unsigned long)object;
    + const char *rel_type;
    + int rel_bytes;

    - pr_err("Object at %p, in cache %s size: %d\n", object, cache->name,
    - cache->object_size);
    + pr_err("The buggy address belongs to the object at %p\n"
    + " which belongs to the cache %s of size %d\n",
    + object, cache->name, cache->object_size);

    - if (!(cache->flags & SLAB_KASAN))
    + if (!addr)
    return;

    - print_track(&alloc_info->alloc_track, "Allocated");
    - print_track(&alloc_info->free_track, "Freed");
    + if (access_addr < object_addr) {
    + rel_type = "to the left";
    + rel_bytes = object_addr - access_addr;
    + } else if (access_addr >= object_addr + cache->object_size) {
    + rel_type = "to the right";
    + rel_bytes = access_addr - (object_addr + cache->object_size);
    + } else {
    + rel_type = "inside";
    + rel_bytes = access_addr - object_addr;
    + }
    +
    + pr_err("The buggy address is located %d bytes %s of\n"
    + " %d-byte region [%p, %p)\n",
    + rel_bytes, rel_type, cache->object_size, (void *)object_addr,
    + (void *)(object_addr + cache->object_size));
    +}
    +
    +static void describe_object(struct kmem_cache *cache, void *object,
    + const void *addr)
    +{
    + struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
    +
    + if (cache->flags & SLAB_KASAN) {
    + print_track(&alloc_info->alloc_track, "Allocated");
    + print_track(&alloc_info->free_track, "Freed");
    + }
    +
    + describe_object_addr(cache, object, addr);
    }

    void kasan_report_double_free(struct kmem_cache *cache, void *object,
    @@ -219,13 +250,13 @@ void kasan_report_double_free(struct kmem_cache *cache, void *object,
    pr_err("BUG: Double free or freeing an invalid pointer\n");
    pr_err("Unexpected shadow byte: 0x%hhX\n", shadow);
    dump_stack();
    - describe_object(cache, object);
    + describe_object(cache, object, NULL);
    kasan_end_report(&flags);
    }

    static void print_address_description(struct kasan_access_info *info)
    {
    - const void *addr = info->access_addr;
    + void *addr = (void *)info->access_addr;
    struct page *page = addr_to_page(addr);

    if (page)
    @@ -235,9 +266,9 @@ static void print_address_description(struct kasan_access_info *info)

    if (page && PageSlab(page)) {
    struct kmem_cache *cache = page->slab_cache;
    - void *object = nearest_obj(cache, page, (void *)addr);
    + void *object = nearest_obj(cache, page, addr);

    - describe_object(cache, object);
    + describe_object(cache, object, addr);
    }

    if (kernel_or_module_addr(addr)) {
    --
    2.12.0.rc1.440.g5b76565f74-goog
    \
     
     \ /
      Last update: 2017-03-02 14:51    [W:4.118 / U:0.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site