0001
0002
0003
0004
0005
0006
0007
0008
0009 #include <linux/bitops.h>
0010 #include <linux/bug.h>
0011 #include <linux/ctype.h>
0012 #include <linux/init.h>
0013 #include <linux/kernel.h>
0014 #include <linux/types.h>
0015 #include <linux/sched.h>
0016 #include <linux/uaccess.h>
0017 #include <kunit/test-bug.h>
0018
0019 #include "ubsan.h"
0020
0021 static const char * const type_check_kinds[] = {
0022 "load of",
0023 "store to",
0024 "reference binding to",
0025 "member access within",
0026 "member call on",
0027 "constructor call on",
0028 "downcast of",
0029 "downcast of"
0030 };
0031
0032 #define REPORTED_BIT 31
0033
0034 #if (BITS_PER_LONG == 64) && defined(__BIG_ENDIAN)
0035 #define COLUMN_MASK (~(1U << REPORTED_BIT))
0036 #define LINE_MASK (~0U)
0037 #else
0038 #define COLUMN_MASK (~0U)
0039 #define LINE_MASK (~(1U << REPORTED_BIT))
0040 #endif
0041
0042 #define VALUE_LENGTH 40
0043
0044 static bool was_reported(struct source_location *location)
0045 {
0046 return test_and_set_bit(REPORTED_BIT, &location->reported);
0047 }
0048
0049 static bool suppress_report(struct source_location *loc)
0050 {
0051 return current->in_ubsan || was_reported(loc);
0052 }
0053
0054 static bool type_is_int(struct type_descriptor *type)
0055 {
0056 return type->type_kind == type_kind_int;
0057 }
0058
0059 static bool type_is_signed(struct type_descriptor *type)
0060 {
0061 WARN_ON(!type_is_int(type));
0062 return type->type_info & 1;
0063 }
0064
0065 static unsigned type_bit_width(struct type_descriptor *type)
0066 {
0067 return 1 << (type->type_info >> 1);
0068 }
0069
0070 static bool is_inline_int(struct type_descriptor *type)
0071 {
0072 unsigned inline_bits = sizeof(unsigned long)*8;
0073 unsigned bits = type_bit_width(type);
0074
0075 WARN_ON(!type_is_int(type));
0076
0077 return bits <= inline_bits;
0078 }
0079
0080 static s_max get_signed_val(struct type_descriptor *type, void *val)
0081 {
0082 if (is_inline_int(type)) {
0083 unsigned extra_bits = sizeof(s_max)*8 - type_bit_width(type);
0084 unsigned long ulong_val = (unsigned long)val;
0085
0086 return ((s_max)ulong_val) << extra_bits >> extra_bits;
0087 }
0088
0089 if (type_bit_width(type) == 64)
0090 return *(s64 *)val;
0091
0092 return *(s_max *)val;
0093 }
0094
0095 static bool val_is_negative(struct type_descriptor *type, void *val)
0096 {
0097 return type_is_signed(type) && get_signed_val(type, val) < 0;
0098 }
0099
0100 static u_max get_unsigned_val(struct type_descriptor *type, void *val)
0101 {
0102 if (is_inline_int(type))
0103 return (unsigned long)val;
0104
0105 if (type_bit_width(type) == 64)
0106 return *(u64 *)val;
0107
0108 return *(u_max *)val;
0109 }
0110
0111 static void val_to_string(char *str, size_t size, struct type_descriptor *type,
0112 void *value)
0113 {
0114 if (type_is_int(type)) {
0115 if (type_bit_width(type) == 128) {
0116 #if defined(CONFIG_ARCH_SUPPORTS_INT128)
0117 u_max val = get_unsigned_val(type, value);
0118
0119 scnprintf(str, size, "0x%08x%08x%08x%08x",
0120 (u32)(val >> 96),
0121 (u32)(val >> 64),
0122 (u32)(val >> 32),
0123 (u32)(val));
0124 #else
0125 WARN_ON(1);
0126 #endif
0127 } else if (type_is_signed(type)) {
0128 scnprintf(str, size, "%lld",
0129 (s64)get_signed_val(type, value));
0130 } else {
0131 scnprintf(str, size, "%llu",
0132 (u64)get_unsigned_val(type, value));
0133 }
0134 }
0135 }
0136
0137 static void ubsan_prologue(struct source_location *loc, const char *reason)
0138 {
0139 current->in_ubsan++;
0140
0141 pr_err("========================================"
0142 "========================================\n");
0143 pr_err("UBSAN: %s in %s:%d:%d\n", reason, loc->file_name,
0144 loc->line & LINE_MASK, loc->column & COLUMN_MASK);
0145
0146 kunit_fail_current_test("%s in %s", reason, loc->file_name);
0147 }
0148
0149 static void ubsan_epilogue(void)
0150 {
0151 dump_stack();
0152 pr_err("========================================"
0153 "========================================\n");
0154
0155 current->in_ubsan--;
0156
0157 if (panic_on_warn)
0158 panic("panic_on_warn set ...\n");
0159 }
0160
0161 void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs)
0162 {
0163 struct overflow_data *data = _data;
0164 char rhs_val_str[VALUE_LENGTH];
0165
0166 if (suppress_report(&data->location))
0167 return;
0168
0169 ubsan_prologue(&data->location, "division-overflow");
0170
0171 val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
0172
0173 if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1)
0174 pr_err("division of %s by -1 cannot be represented in type %s\n",
0175 rhs_val_str, data->type->type_name);
0176 else
0177 pr_err("division by zero\n");
0178
0179 ubsan_epilogue();
0180 }
0181 EXPORT_SYMBOL(__ubsan_handle_divrem_overflow);
0182
0183 static void handle_null_ptr_deref(struct type_mismatch_data_common *data)
0184 {
0185 if (suppress_report(data->location))
0186 return;
0187
0188 ubsan_prologue(data->location, "null-ptr-deref");
0189
0190 pr_err("%s null pointer of type %s\n",
0191 type_check_kinds[data->type_check_kind],
0192 data->type->type_name);
0193
0194 ubsan_epilogue();
0195 }
0196
0197 static void handle_misaligned_access(struct type_mismatch_data_common *data,
0198 unsigned long ptr)
0199 {
0200 if (suppress_report(data->location))
0201 return;
0202
0203 ubsan_prologue(data->location, "misaligned-access");
0204
0205 pr_err("%s misaligned address %p for type %s\n",
0206 type_check_kinds[data->type_check_kind],
0207 (void *)ptr, data->type->type_name);
0208 pr_err("which requires %ld byte alignment\n", data->alignment);
0209
0210 ubsan_epilogue();
0211 }
0212
0213 static void handle_object_size_mismatch(struct type_mismatch_data_common *data,
0214 unsigned long ptr)
0215 {
0216 if (suppress_report(data->location))
0217 return;
0218
0219 ubsan_prologue(data->location, "object-size-mismatch");
0220 pr_err("%s address %p with insufficient space\n",
0221 type_check_kinds[data->type_check_kind],
0222 (void *) ptr);
0223 pr_err("for an object of type %s\n", data->type->type_name);
0224 ubsan_epilogue();
0225 }
0226
0227 static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data,
0228 unsigned long ptr)
0229 {
0230 unsigned long flags = user_access_save();
0231
0232 if (!ptr)
0233 handle_null_ptr_deref(data);
0234 else if (data->alignment && !IS_ALIGNED(ptr, data->alignment))
0235 handle_misaligned_access(data, ptr);
0236 else
0237 handle_object_size_mismatch(data, ptr);
0238
0239 user_access_restore(flags);
0240 }
0241
0242 void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
0243 void *ptr)
0244 {
0245 struct type_mismatch_data_common common_data = {
0246 .location = &data->location,
0247 .type = data->type,
0248 .alignment = data->alignment,
0249 .type_check_kind = data->type_check_kind
0250 };
0251
0252 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
0253 }
0254 EXPORT_SYMBOL(__ubsan_handle_type_mismatch);
0255
0256 void __ubsan_handle_type_mismatch_v1(void *_data, void *ptr)
0257 {
0258 struct type_mismatch_data_v1 *data = _data;
0259 struct type_mismatch_data_common common_data = {
0260 .location = &data->location,
0261 .type = data->type,
0262 .alignment = 1UL << data->log_alignment,
0263 .type_check_kind = data->type_check_kind
0264 };
0265
0266 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
0267 }
0268 EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1);
0269
0270 void __ubsan_handle_out_of_bounds(void *_data, void *index)
0271 {
0272 struct out_of_bounds_data *data = _data;
0273 char index_str[VALUE_LENGTH];
0274
0275 if (suppress_report(&data->location))
0276 return;
0277
0278 ubsan_prologue(&data->location, "array-index-out-of-bounds");
0279
0280 val_to_string(index_str, sizeof(index_str), data->index_type, index);
0281 pr_err("index %s is out of range for type %s\n", index_str,
0282 data->array_type->type_name);
0283 ubsan_epilogue();
0284 }
0285 EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
0286
0287 void __ubsan_handle_shift_out_of_bounds(void *_data, void *lhs, void *rhs)
0288 {
0289 struct shift_out_of_bounds_data *data = _data;
0290 struct type_descriptor *rhs_type = data->rhs_type;
0291 struct type_descriptor *lhs_type = data->lhs_type;
0292 char rhs_str[VALUE_LENGTH];
0293 char lhs_str[VALUE_LENGTH];
0294 unsigned long ua_flags = user_access_save();
0295
0296 if (suppress_report(&data->location))
0297 goto out;
0298
0299 ubsan_prologue(&data->location, "shift-out-of-bounds");
0300
0301 val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
0302 val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
0303
0304 if (val_is_negative(rhs_type, rhs))
0305 pr_err("shift exponent %s is negative\n", rhs_str);
0306
0307 else if (get_unsigned_val(rhs_type, rhs) >=
0308 type_bit_width(lhs_type))
0309 pr_err("shift exponent %s is too large for %u-bit type %s\n",
0310 rhs_str,
0311 type_bit_width(lhs_type),
0312 lhs_type->type_name);
0313 else if (val_is_negative(lhs_type, lhs))
0314 pr_err("left shift of negative value %s\n",
0315 lhs_str);
0316 else
0317 pr_err("left shift of %s by %s places cannot be"
0318 " represented in type %s\n",
0319 lhs_str, rhs_str,
0320 lhs_type->type_name);
0321
0322 ubsan_epilogue();
0323 out:
0324 user_access_restore(ua_flags);
0325 }
0326 EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
0327
0328
0329 void __ubsan_handle_builtin_unreachable(void *_data)
0330 {
0331 struct unreachable_data *data = _data;
0332 ubsan_prologue(&data->location, "unreachable");
0333 pr_err("calling __builtin_unreachable()\n");
0334 ubsan_epilogue();
0335 panic("can't return from __builtin_unreachable()");
0336 }
0337 EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
0338
0339 void __ubsan_handle_load_invalid_value(void *_data, void *val)
0340 {
0341 struct invalid_value_data *data = _data;
0342 char val_str[VALUE_LENGTH];
0343
0344 if (suppress_report(&data->location))
0345 return;
0346
0347 ubsan_prologue(&data->location, "invalid-load");
0348
0349 val_to_string(val_str, sizeof(val_str), data->type, val);
0350
0351 pr_err("load of value %s is not a valid value for type %s\n",
0352 val_str, data->type->type_name);
0353
0354 ubsan_epilogue();
0355 }
0356 EXPORT_SYMBOL(__ubsan_handle_load_invalid_value);
0357
0358 void __ubsan_handle_alignment_assumption(void *_data, unsigned long ptr,
0359 unsigned long align,
0360 unsigned long offset);
0361 void __ubsan_handle_alignment_assumption(void *_data, unsigned long ptr,
0362 unsigned long align,
0363 unsigned long offset)
0364 {
0365 struct alignment_assumption_data *data = _data;
0366 unsigned long real_ptr;
0367
0368 if (suppress_report(&data->location))
0369 return;
0370
0371 ubsan_prologue(&data->location, "alignment-assumption");
0372
0373 if (offset)
0374 pr_err("assumption of %lu byte alignment (with offset of %lu byte) for pointer of type %s failed",
0375 align, offset, data->type->type_name);
0376 else
0377 pr_err("assumption of %lu byte alignment for pointer of type %s failed",
0378 align, data->type->type_name);
0379
0380 real_ptr = ptr - offset;
0381 pr_err("%saddress is %lu aligned, misalignment offset is %lu bytes",
0382 offset ? "offset " : "", BIT(real_ptr ? __ffs(real_ptr) : 0),
0383 real_ptr & (align - 1));
0384
0385 ubsan_epilogue();
0386 }
0387 EXPORT_SYMBOL(__ubsan_handle_alignment_assumption);
