kasan: improve error reports

Andrey Konovalov linux-mm lkml netdev 4 versions Nov 8, 2016 – Mar 24, 2017 In review

Get series with b4

b4 am [email protected]

Versions newest first · linked by author and title

v4 Latest Mar 24, 20179 patches 2 repliesIn review
v3 Mar 6, 20179 patches 0 repliesSuperseded
v2 Mar 2, 20179 patches 18 repliesApplied 9/9

Earlier versions · 1

Version	Posted	Patches	Replies	Status
v1	Nov 8, 2016	2 patches	4 replies	Superseded

Changes in v4 from the cover letter

- reduced amount of info printed in slab object description

Patches in v4 No applies recorded yet

#	Subject and files	Size	Replies
1/9	kasan: introduce helper functions for determining bug type`mm/kasan/report.c`	+30 ~~-10~~	1 reply
1/9	kasan: introduce helper functions for determining bug type`mm/kasan/report.c`	+30 ~~-10~~	0 replies
2/9	kasan: unify report headers`mm/kasan/report.c`	+13 ~~-13~~	0 replies
2/9	kasan: unify report headers`mm/kasan/report.c`	+13 ~~-13~~	0 replies
3/9	kasan: change allocation and freeing stack traces headers`mm/kasan/report.c`	+4 -6	0 replies
3/9	kasan: change allocation and freeing stack traces headers`mm/kasan/report.c`	+4 -6	0 replies
4/9	kasan: simplify address description logic`mm/kasan/report.c`	+20 ~~-16~~	0 replies
4/9	kasan: simplify address description logic`mm/kasan/report.c`	+20 ~~-16~~	0 replies
5/9	kasan: change report header`mm/kasan/report.c`	+3 -4	0 replies
5/9	kasan: change report header`mm/kasan/report.c`	+3 -4	0 replies
6/9	kasan: improve slab object description`mm/kasan/report.c`	+27 ~~-11~~	0 replies
6/9	kasan: improve slab object description`mm/kasan/report.c`	+27 ~~-11~~	0 replies
7/9	kasan: print page description after stacks`mm/kasan/report.c`	+8 -6	0 replies
7/9	kasan: print page description after stacks`mm/kasan/report.c`	+8 -6	0 replies
8/9	kasan: improve double-free report format`include/linux/kasan.h` `mm/kasan/kasan.c` `mm/kasan/kasan.h` +3 more	+27 ~~-26~~	0 replies
8/9	kasan: improve double-free report format`include/linux/kasan.h` `mm/kasan/kasan.c` `mm/kasan/kasan.h` +3 more	+27 ~~-26~~	0 replies
9/9	kasan: separate report parts by empty lines`mm/kasan/report.c`	+7 -0	0 replies
9/9	kasan: separate report parts by empty lines`mm/kasan/report.c`	+7 -0	0 replies

Reviews trailers per patch

None of the 18 patches has a Reviewed-by or Acked-by of their own; the series has one for all of them.

Patch	Andrey Ryabinin
Series	A-b
1/9
1/9
2/9
2/9
3/9
3/9
4/9
4/9
5/9
5/9
6/9
6/9
7/9
7/9
8/9
8/9
9/9
9/9

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v4 thread

Cover letter [PATCH v4 0/9] kasan: improve error reports

This patchset improves KASAN reports by making them easier to read and a little more detailed.
Also improves mm/kasan/report.c readability.

Effectively changes a use-after-free report to:

==================================================================

BUG: KASAN: use-after-free in kmalloc_uaf+0xaa/0xb6 [test_kasan]
Write of size 1 at addr ffff88006aa59da8 by task insmod/3951

CPU: 1 PID: 3951 Comm: insmod Tainted: G    B           4.10.0+ #84
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 dump_stack+0x292/0x398
 print_address_description+0x73/0x280
 kasan_report.part.2+0x207/0x2f0
 __asan_report_store1_noabort+0x2c/0x30
 kmalloc_uaf+0xaa/0xb6 [test_kasan]
 kmalloc_tests_init+0x4f/0xa48 [test_kasan]
 do_one_initcall+0xf3/0x390
 do_init_module+0x215/0x5d0
 load_module+0x54de/0x82b0
 SYSC_init_module+0x3be/0x430
 SyS_init_module+0x9/0x10
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x7f22cfd0b9da
RSP: 002b:00007ffe69118a78 EFLAGS: 00000206 ORIG_RAX: 00000000000000af
RAX: ffffffffffffffda RBX: 0000555671242090 RCX: 00007f22cfd0b9da
RDX: 00007f22cffcaf88 RSI: 000000000004df7e RDI: 00007f22d0399000
RBP: 00007f22cffcaf88 R08: 0000000000000003 R09: 0000000000000000
R10: 00007f22cfd07d0a R11: 0000000000000206 R12: 0000555671243190
R13: 000000000001fe81 R14: 0000000000000000 R15: 0000000000000004

Allocated by task 3951:
 save_stack_trace+0x16/0x20
 save_stack+0x43/0xd0
 kasan_kmalloc+0xad/0xe0
 kmem_cache_alloc_trace+0x82/0x270
 kmalloc_uaf+0x56/0xb6 [test_kasan]
 kmalloc_tests_init+0x4f/0xa48 [test_kasan]
 do_one_initcall+0xf3/0x390
 do_init_module+0x215/0x5d0
 load_module+0x54de/0x82b0
 SYSC_init_module+0x3be/0x430
 SyS_init_module+0x9/0x10
 entry_SYSCALL_64_fastpath+0x1f/0xc2

Freed by task 3951:
 save_stack_trace+0x16/0x20
 save_stack+0x43/0xd0
 kasan_slab_free+0x72/0xc0
 kfree+0xe8/0x2b0
 kmalloc_uaf+0x85/0xb6 [test_kasan]
 kmalloc_tests_init+0x4f/0xa48 [test_kasan]
 do_one_initcall+0xf3/0x390
 do_init_module+0x215/0x5d0
 load_module+0x54de/0x82b0
 SYSC_init_module+0x3be/0x430
 SyS_init_module+0x9/0x10
 entry_SYSCALL_64_fastpath+0x1f/0xc

Object at ffff88006bfb0da0 belongs to cache kmalloc-16 of size 16
accessed at offset 8

The buggy address belongs to the page:
page:ffffea0001aa9640 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x100000000000100(slab)
raw: 0100000000000100 0000000000000000 0000000000000000 0000000180800080
raw: ffffea0001abe380 0000000700000007 ffff88006c401b40 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88006aa59c80: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
 ffff88006aa59d00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
>ffff88006aa59d80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
                                  ^
 ffff88006aa59e00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
 ffff88006aa59e80: fb fb fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc
==================================================================

from:

==================================================================

BUG: KASAN: use-after-free in kmalloc_uaf+0xaa/0xb6 [test_kasan] at addr ffff88006c4dcb28
Write of size 1 by task insmod/3984
CPU: 1 PID: 3984 Comm: insmod Tainted: G    B           4.10.0+ #83
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 dump_stack+0x292/0x398
 kasan_object_err+0x1c/0x70
 kasan_report.part.1+0x20e/0x4e0
 __asan_report_store1_noabort+0x2c/0x30
 kmalloc_uaf+0xaa/0xb6 [test_kasan]
 kmalloc_tests_init+0x4f/0xa48 [test_kasan]
 do_one_initcall+0xf3/0x390
 do_init_module+0x215/0x5d0
 load_module+0x54de/0x82b0
 SYSC_init_module+0x3be/0x430
 SyS_init_module+0x9/0x10
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x7feca0f779da
RSP: 002b:00007ffdfeae5218 EFLAGS: 00000206 ORIG_RAX: 00000000000000af
RAX: ffffffffffffffda RBX: 000055a064c13090 RCX: 00007feca0f779da
RDX: 00007feca1236f88 RSI: 000000000004df7e RDI: 00007feca1605000
RBP: 00007feca1236f88 R08: 0000000000000003 R09: 0000000000000000
R10: 00007feca0f73d0a R11: 0000000000000206 R12: 000055a064c14190
R13: 000000000001fe81 R14: 0000000000000000 R15: 0000000000000004
Object at ffff88006c4dcb20, in cache kmalloc-16 size: 16
Allocated:
PID = 3984
 save_stack_trace+0x16/0x20
 save_stack+0x43/0xd0
 kasan_kmalloc+0xad/0xe0
 kmem_cache_alloc_trace+0x82/0x270
 kmalloc_uaf+0x56/0xb6 [test_kasan]
 kmalloc_tests_init+0x4f/0xa48 [test_kasan]
 do_one_initcall+0xf3/0x390
 do_init_module+0x215/0x5d0
 load_module+0x54de/0x82b0
 SYSC_init_module+0x3be/0x430
 SyS_init_module+0x9/0x10
 entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 3984
 save_stack_trace+0x16/0x20
 save_stack+0x43/0xd0
 kasan_slab_free+0x73/0xc0
 kfree+0xe8/0x2b0
 kmalloc_uaf+0x85/0xb6 [test_kasan]
 kmalloc_tests_init+0x4f/0xa48 [test_kasan]
 do_one_initcall+0xf3/0x390
 do_init_module+0x215/0x5d0
 load_module+0x54de/0x82b0
 SYSC_init_module+0x3be/0x430
 SyS_init_module+0x9/0x10
 entry_SYSCALL_64_fastpath+0x1f/0xc2
Memory state around the buggy address:
 ffff88006c4dca00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
 ffff88006c4dca80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
>ffff88006c4dcb00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
                                  ^
 ffff88006c4dcb80: fb fb fc fc 00 00 fc fc fb fb fc fc fb fb fc fc
 ffff88006c4dcc00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
==================================================================

Changes in v4:
- reduced amount of info printed in slab object description

Changes in v3:
- make slab objects description shorter
- pass caller addr from SLUB/SLAB instead of usign __builtin_return_address
- make get_wild_bug_type() static
- combine consequent lines into one when possible

Changes in v2:
- split patch in multiple smaller ones
- improve double-free reports

Andrey Konovalov (9):
kasan: introduce helper functions for determining bug type
kasan: unify report headers
kasan: change allocation and freeing stack traces headers
kasan: simplify address description logic
kasan: change report header
kasan: improve slab object description
kasan: print page description after stacks
kasan: improve double-free report format
kasan: separate report parts by empty lines

 include/linux/kasan.h |   2 +-
 mm/kasan/kasan.c      |   5 +-
 mm/kasan/kasan.h      |   2 +-
 mm/kasan/report.c     | 172 +++++++++++++++++++++++++++++++-------------------
 mm/slab.c             |   2 +-
 mm/slub.c             |  12 ++--
 6 files changed, 121 insertions(+), 74 deletions(-)

Signature · 7 lines

2.12.1.578.ge9c3154ca4-goog

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Read the cover letter in its thread