Merge branch 'akpm' (patches from Andrew)

[linux.git] / mm / kasan / report.c

diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 621782100eaa0f81d930799c6899d598db390550..5ef9f24f566b438a3a8de742fbf20dc0ccca8e75 100644 (file)
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -512,3 +512,43 @@ void __kasan_report(unsigned long addr, size_t size, bool is_write, unsigned lon
 
        end_report(&flags);
 }
+
+#ifdef CONFIG_KASAN_INLINE
+/*
+ * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high
+ * canonical half of the address space) cause out-of-bounds shadow memory reads
+ * before the actual access. For addresses in the low canonical half of the
+ * address space, as well as most non-canonical addresses, that out-of-bounds
+ * shadow memory access lands in the non-canonical part of the address space.
+ * Help the user figure out what the original bogus pointer was.
+ */
+void kasan_non_canonical_hook(unsigned long addr)
+{
+       unsigned long orig_addr;
+       const char *bug_type;
+
+       if (addr < KASAN_SHADOW_OFFSET)
+               return;
+
+       orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT;
+       /*
+        * For faults near the shadow address for NULL, we can be fairly certain
+        * that this is a KASAN shadow memory access.
+        * For faults that correspond to shadow for low canonical addresses, we
+        * can still be pretty sure - that shadow region is a fairly narrow
+        * chunk of the non-canonical address space.
+        * But faults that look like shadow for non-canonical addresses are a
+        * really large chunk of the address space. In that case, we still
+        * print the decoded address, but make it clear that this is not
+        * necessarily what's actually going on.
+        */
+       if (orig_addr < PAGE_SIZE)
+               bug_type = "null-ptr-deref";
+       else if (orig_addr < TASK_SIZE)
+               bug_type = "probably user-memory-access";
+       else
+               bug_type = "maybe wild-memory-access";
+       pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,
+                orig_addr, orig_addr + KASAN_SHADOW_MASK);
+}
+#endif