1 // SPDX-License-Identifier: GPL-2.0
8  * Some code borrowed from https://github.com/xairy/kasan-prototype by
40  * depending on memory access size X.
56 						unsigned long size)  in memory_is_poisoned_2_4_8()  argument
61 	 * Access crosses 8(shadow size)-byte boundary. Such access maps  in memory_is_poisoned_2_4_8()
64 	if (unlikely(((addr + size - 1) & KASAN_GRANULE_MASK) < size - 1))  in memory_is_poisoned_2_4_8()
65 		return *shadow_addr || memory_is_poisoned_1(addr + size - 1);  in memory_is_poisoned_2_4_8()
67 	return memory_is_poisoned_1(addr + size - 1);  in memory_is_poisoned_2_4_8()
74 	/* Unaligned 16-bytes access maps into 3 shadow bytes. */  in memory_is_poisoned_16()
82 					size_t size)  in bytes_is_nonzero()  argument
84 	while (size) {  in bytes_is_nonzero()
88 		size--;  in bytes_is_nonzero()
101 	if (end - start <= 16)  in memory_is_nonzero()
102 		return bytes_is_nonzero(start, end - start);  in memory_is_nonzero()
105 		prefix = 8 - prefix;  in memory_is_nonzero()
112 	words = (end - start) / 8;  in memory_is_nonzero()
117 		words--;  in memory_is_nonzero()
120 	return bytes_is_nonzero(start, (end - start) % 8);  in memory_is_nonzero()
124 						size_t size)  in memory_is_poisoned_n()  argument
129 			kasan_mem_to_shadow((void *)addr + size - 1) + 1);  in memory_is_poisoned_n()
132 		unsigned long last_byte = addr + size - 1;  in memory_is_poisoned_n()
142 static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size)  in memory_is_poisoned()  argument
144 	if (__builtin_constant_p(size)) {  in memory_is_poisoned()
145 		switch (size) {  in memory_is_poisoned()
151 			return memory_is_poisoned_2_4_8(addr, size);  in memory_is_poisoned()
159 	return memory_is_poisoned_n(addr, size);  in memory_is_poisoned()
163 						size_t size, bool write,  in check_region_inline()  argument
169 	if (unlikely(size == 0))  in check_region_inline()
172 	if (unlikely(addr + size < addr))  in check_region_inline()
173 		return !kasan_report(addr, size, write, ret_ip);  in check_region_inline()
177 		return !kasan_report(addr, size, write, ret_ip);  in check_region_inline()
180 	if (likely(!memory_is_poisoned(addr, size)))  in check_region_inline()
183 	return !kasan_report(addr, size, write, ret_ip);  in check_region_inline()
186 bool kasan_check_range(unsigned long addr, size_t size, bool write,  in kasan_check_range()  argument
189 	return check_region_inline(addr, size, write, ret_ip);  in kasan_check_range()
199 void kasan_cache_shrink(struct kmem_cache *cache)  in kasan_cache_shrink()  argument
201 	kasan_quarantine_remove_cache(cache);  in kasan_cache_shrink()
204 void kasan_cache_shutdown(struct kmem_cache *cache)  in kasan_cache_shutdown()  argument
206 	if (!__kmem_cache_empty(cache))  in kasan_cache_shutdown()
207 		kasan_quarantine_remove_cache(cache);  in kasan_cache_shutdown()
212 	size_t aligned_size = round_up(global->size, KASAN_GRANULE_SIZE);  in register_global()
214 	kasan_unpoison(global->beg, global->size, false);  in register_global()
216 	kasan_poison(global->beg + aligned_size,  in register_global()
217 		     global->size_with_redzone - aligned_size,  in register_global()
221 void __asan_register_globals(struct kasan_global *globals, size_t size)  in __asan_register_globals()  argument
225 	for (i = 0; i < size; i++)  in __asan_register_globals()
230 void __asan_unregister_globals(struct kasan_global *globals, size_t size)  in __asan_unregister_globals()  argument
235 #define DEFINE_ASAN_LOAD_STORE(size)					\  argument
236 	void __asan_load##size(unsigned long addr)			\
238 		check_region_inline(addr, size, false, _RET_IP_);	\
240 	EXPORT_SYMBOL(__asan_load##size);				\
241 	__alias(__asan_load##size)					\
242 	void __asan_load##size##_noabort(unsigned long);		\
243 	EXPORT_SYMBOL(__asan_load##size##_noabort);			\
244 	void __asan_store##size(unsigned long addr)			\
246 		check_region_inline(addr, size, true, _RET_IP_);	\
248 	EXPORT_SYMBOL(__asan_store##size);				\
249 	__alias(__asan_store##size)					\
250 	void __asan_store##size##_noabort(unsigned long);		\
251 	EXPORT_SYMBOL(__asan_store##size##_noabort)
259 void __asan_loadN(unsigned long addr, size_t size)  in __asan_loadN()  argument
261 	kasan_check_range(addr, size, false, _RET_IP_);  in __asan_loadN()
269 void __asan_storeN(unsigned long addr, size_t size)  in __asan_storeN()  argument
271 	kasan_check_range(addr, size, true, _RET_IP_);  in __asan_storeN()
284 void __asan_alloca_poison(unsigned long addr, size_t size)  in __asan_alloca_poison()  argument
286 	size_t rounded_up_size = round_up(size, KASAN_GRANULE_SIZE);  in __asan_alloca_poison()
287 	size_t padding_size = round_up(size, KASAN_ALLOCA_REDZONE_SIZE) -  in __asan_alloca_poison()
289 	size_t rounded_down_size = round_down(size, KASAN_GRANULE_SIZE);  in __asan_alloca_poison()
291 	const void *left_redzone = (const void *)(addr -  in __asan_alloca_poison()
298 			size - rounded_down_size, false);  in __asan_alloca_poison()
312 	kasan_unpoison(stack_top, stack_bottom - stack_top, false);  in __asan_allocas_unpoison()
318 	void __asan_set_shadow_##byte(const void *addr, size_t size)	\
320 		__memset((void *)addr, 0x##byte, size);			\
331 /* Only allow cache merging when no per-object metadata is present. */
346 		object_size <= 64        - 16   ? 16 :  in optimal_redzone()
347 		object_size <= 128       - 32   ? 32 :  in optimal_redzone()
348 		object_size <= 512       - 64   ? 64 :  in optimal_redzone()
349 		object_size <= 4096      - 128  ? 128 :  in optimal_redzone()
350 		object_size <= (1 << 14) - 256  ? 256 :  in optimal_redzone()
351 		object_size <= (1 << 15) - 512  ? 512 :  in optimal_redzone()
352 		object_size <= (1 << 16) - 1024 ? 1024 : 2048;  in optimal_redzone()
355 void kasan_cache_create(struct kmem_cache *cache, unsigned int *size,  in kasan_cache_create()  argument
366 	 * and that thus have per-object metadata.  in kasan_cache_create()
368 	 * 1. In slab_ksize() to account for per-object metadata when  in kasan_cache_create()
369 	 *    calculating the size of the accessible memory within the object.  in kasan_cache_create()
371 	 *    caches with per-object metadata.  in kasan_cache_create()
375 	ok_size = *size;  in kasan_cache_create()
378 	cache->kasan_info.alloc_meta_offset = *size;  in kasan_cache_create()
379 	*size += sizeof(struct kasan_alloc_meta);  in kasan_cache_create()
387 	if (*size > KMALLOC_MAX_SIZE) {  in kasan_cache_create()
388 		cache->kasan_info.alloc_meta_offset = 0;  in kasan_cache_create()
389 		*size = ok_size;  in kasan_cache_create()
401 	 * Otherwise cache->kasan_info.free_meta_offset = 0 is implied.  in kasan_cache_create()
403 	if ((cache->flags & SLAB_TYPESAFE_BY_RCU) || cache->ctor ||  in kasan_cache_create()
404 	    cache->object_size < sizeof(struct kasan_free_meta)) {  in kasan_cache_create()
405 		ok_size = *size;  in kasan_cache_create()
407 		cache->kasan_info.free_meta_offset = *size;  in kasan_cache_create()
408 		*size += sizeof(struct kasan_free_meta);  in kasan_cache_create()
411 		if (*size > KMALLOC_MAX_SIZE) {  in kasan_cache_create()
412 			cache->kasan_info.free_meta_offset = KASAN_NO_FREE_META;  in kasan_cache_create()
413 			*size = ok_size;  in kasan_cache_create()
417 	/* Calculate size with optimal redzone. */  in kasan_cache_create()
418 	optimal_size = cache->object_size + optimal_redzone(cache->object_size);  in kasan_cache_create()
422 	/* Use optimal size if the size with added metas is not large enough. */  in kasan_cache_create()
423 	if (*size < optimal_size)  in kasan_cache_create()
424 		*size = optimal_size;  in kasan_cache_create()
427 struct kasan_alloc_meta *kasan_get_alloc_meta(struct kmem_cache *cache,  in kasan_get_alloc_meta()  argument
430 	if (!cache->kasan_info.alloc_meta_offset)  in kasan_get_alloc_meta()
432 	return (void *)object + cache->kasan_info.alloc_meta_offset;  in kasan_get_alloc_meta()
435 struct kasan_free_meta *kasan_get_free_meta(struct kmem_cache *cache,  in kasan_get_free_meta()  argument
439 	if (cache->kasan_info.free_meta_offset == KASAN_NO_FREE_META)  in kasan_get_free_meta()
441 	return (void *)object + cache->kasan_info.free_meta_offset;  in kasan_get_free_meta()
444 void kasan_init_object_meta(struct kmem_cache *cache, const void *object)  in kasan_init_object_meta()  argument
448 	alloc_meta = kasan_get_alloc_meta(cache, object);  in kasan_init_object_meta()
453 size_t kasan_metadata_size(struct kmem_cache *cache)  in kasan_metadata_size()  argument
457 	return (cache->kasan_info.alloc_meta_offset ?  in kasan_metadata_size()
459 		((cache->kasan_info.free_meta_offset &&  in kasan_metadata_size()
460 		  cache->kasan_info.free_meta_offset != KASAN_NO_FREE_META) ?  in kasan_metadata_size()
467 	struct kmem_cache *cache;  in __kasan_record_aux_stack()  local
474 	cache = slab->slab_cache;  in __kasan_record_aux_stack()
475 	object = nearest_obj(cache, slab, addr);  in __kasan_record_aux_stack()
476 	alloc_meta = kasan_get_alloc_meta(cache, object);  in __kasan_record_aux_stack()
480 	alloc_meta->aux_stack[1] = alloc_meta->aux_stack[0];  in __kasan_record_aux_stack()
481 	alloc_meta->aux_stack[0] = kasan_save_stack(GFP_NOWAIT, can_alloc);  in __kasan_record_aux_stack()
494 void kasan_save_alloc_info(struct kmem_cache *cache, void *object, gfp_t flags)  in kasan_save_alloc_info()  argument
498 	alloc_meta = kasan_get_alloc_meta(cache, object);  in kasan_save_alloc_info()
500 		kasan_set_track(&alloc_meta->alloc_track, flags);  in kasan_save_alloc_info()
503 void kasan_save_free_info(struct kmem_cache *cache, void *object)  in kasan_save_free_info()  argument
507 	free_meta = kasan_get_free_meta(cache, object);  in kasan_save_free_info()
511 	kasan_set_track(&free_meta->free_track, GFP_NOWAIT);  in kasan_save_free_info()