1 // SPDX-License-Identifier: GPL-2.0
5  * Copyright (c) 2014 Samsung Electronics Co., Ltd.
8  * Some code borrowed from https://github.com/xairy/kasan-prototype by
61 	while (size < cache->object_size) {  in kasan_get_alloc_size()
64 		else if (*shadow >= 1 && *shadow <= KASAN_GRANULE_SIZE - 1)  in kasan_get_alloc_size()
71 	return cache->object_size;  in kasan_get_alloc_size()
76 	const char *bug_type = "unknown-crash";  in get_shadow_bug_type()
79 	shadow_addr = (u8 *)kasan_mem_to_shadow(info->first_bad_addr);  in get_shadow_bug_type()
85 	if (*shadow_addr > 0 && *shadow_addr <= KASAN_GRANULE_SIZE - 1)  in get_shadow_bug_type()
89 	case 0 ... KASAN_GRANULE_SIZE - 1:  in get_shadow_bug_type()
94 		bug_type = "out-of-bounds";  in get_shadow_bug_type()
98 		bug_type = "slab-out-of-bounds";  in get_shadow_bug_type()
101 		bug_type = "global-out-of-bounds";  in get_shadow_bug_type()
107 		bug_type = "stack-out-of-bounds";  in get_shadow_bug_type()
110 		bug_type = "use-after-free";  in get_shadow_bug_type()
114 		bug_type = "slab-use-after-free";  in get_shadow_bug_type()
118 		bug_type = "alloca-out-of-bounds";  in get_shadow_bug_type()
121 		bug_type = "vmalloc-out-of-bounds";  in get_shadow_bug_type()
130 	const char *bug_type = "unknown-crash";  in get_wild_bug_type()
132 	if ((unsigned long)info->access_addr < PAGE_SIZE)  in get_wild_bug_type()
133 		bug_type = "null-ptr-deref";  in get_wild_bug_type()
134 	else if ((unsigned long)info->access_addr < TASK_SIZE)  in get_wild_bug_type()
135 		bug_type = "user-memory-access";  in get_wild_bug_type()
137 		bug_type = "wild-memory-access";  in get_wild_bug_type()
146 	 * defined as out-of-bounds bug type.  in get_bug_type()
150 	 * so that this can qualify as out-of-bounds.  in get_bug_type()
152 	if (info->access_addr + info->access_size < info->access_addr)  in get_bug_type()
153 		return "out-of-bounds";  in get_bug_type()
155 	if (addr_has_metadata(info->access_addr))  in get_bug_type()
165 	if (!info->bug_type)  in kasan_complete_mode_report_info()
166 		info->bug_type = get_bug_type(info);  in kasan_complete_mode_report_info()
168 	if (!info->cache || !info->object)  in kasan_complete_mode_report_info()
171 	alloc_meta = kasan_get_alloc_meta(info->cache, info->object);  in kasan_complete_mode_report_info()
173 		memcpy(&info->alloc_track, &alloc_meta->alloc_track,  in kasan_complete_mode_report_info()
174 		       sizeof(info->alloc_track));  in kasan_complete_mode_report_info()
176 	if (*(u8 *)kasan_mem_to_shadow(info->object) == KASAN_SLAB_FREE_META) {  in kasan_complete_mode_report_info()
178 		free_meta = kasan_get_free_meta(info->cache, info->object);  in kasan_complete_mode_report_info()
179 		memcpy(&info->free_track, &free_meta->free_track,  in kasan_complete_mode_report_info()
180 		       sizeof(info->free_track));  in kasan_complete_mode_report_info()
197 	if (alloc_meta->aux_stack[0]) {  in kasan_print_aux_stacks()
199 		stack_depot_print(alloc_meta->aux_stack[0]);  in kasan_print_aux_stacks()
202 	if (alloc_meta->aux_stack[1]) {  in kasan_print_aux_stacks()
204 		stack_depot_print(alloc_meta->aux_stack[1]);  in kasan_print_aux_stacks()
220 		const size_t tok_len = sep - *frame_descr;  in tokenize_frame_descr()
264 	while (num_objects--) {  in print_decoded_frame_descr()
312 		shadow_ptr--;  in get_address_stack_frame_info()
313 		mem_ptr -= KASAN_GRANULE_SIZE;  in get_address_stack_frame_info()
317 		shadow_ptr--;  in get_address_stack_frame_info()
318 		mem_ptr -= KASAN_GRANULE_SIZE;  in get_address_stack_frame_info()
331 	*offset = (unsigned long)addr - (unsigned long)frame;  in get_address_stack_frame_info()
348 	       current->comm, task_pid_nr(current));  in kasan_print_address_stack_frame()
354 	pr_err(" and is located at offset %lu in frame:\n", offset);  in kasan_print_address_stack_frame()