From: Andrey Konovalov <andreyknvl@google.com>
To: Andrey Ryabinin <aryabinin@virtuozzo.com>,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
kasan-dev@googlegroups.com, linux-mm@kvack.org,
linux-kernel@vger.kernel.org
Cc: Andrey Konovalov <andreyknvl@google.com>
Subject: [PATCH v2 6/9] kasan: improve slab object description
Date: Thu, 2 Mar 2017 14:48:48 +0100 [thread overview]
Message-ID: <20170302134851.101218-7-andreyknvl@google.com> (raw)
In-Reply-To: <20170302134851.101218-1-andreyknvl@google.com>
Changes slab object description from:
Object at ffff880068388540, in cache kmalloc-128 size: 128
to:
The buggy address belongs to the object at ffff880068388540
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 123 bytes inside of
128-byte region [ffff880068388540, ffff8800683885c0)
Makes it more explanatory and adds information about relative offset
of the accessed address to the start of the object.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
mm/kasan/report.c | 53 ++++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 42 insertions(+), 11 deletions(-)
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 945d0e13e8a4..8dfb7a060d69 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -196,18 +196,49 @@ static struct page *addr_to_page(const void *addr)
return NULL;
}
-static void describe_object(struct kmem_cache *cache, void *object)
+static void describe_object_addr(struct kmem_cache *cache, void *object,
+ const void *addr)
{
- struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
+ unsigned long access_addr = (unsigned long)addr;
+ unsigned long object_addr = (unsigned long)object;
+ const char *rel_type;
+ int rel_bytes;
- pr_err("Object at %p, in cache %s size: %d\n", object, cache->name,
- cache->object_size);
+ pr_err("The buggy address belongs to the object at %p\n"
+ " which belongs to the cache %s of size %d\n",
+ object, cache->name, cache->object_size);
- if (!(cache->flags & SLAB_KASAN))
+ if (!addr)
return;
- print_track(&alloc_info->alloc_track, "Allocated");
- print_track(&alloc_info->free_track, "Freed");
+ if (access_addr < object_addr) {
+ rel_type = "to the left";
+ rel_bytes = object_addr - access_addr;
+ } else if (access_addr >= object_addr + cache->object_size) {
+ rel_type = "to the right";
+ rel_bytes = access_addr - (object_addr + cache->object_size);
+ } else {
+ rel_type = "inside";
+ rel_bytes = access_addr - object_addr;
+ }
+
+ pr_err("The buggy address is located %d bytes %s of\n"
+ " %d-byte region [%p, %p)\n",
+ rel_bytes, rel_type, cache->object_size, (void *)object_addr,
+ (void *)(object_addr + cache->object_size));
+}
+
+static void describe_object(struct kmem_cache *cache, void *object,
+ const void *addr)
+{
+ struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
+
+ if (cache->flags & SLAB_KASAN) {
+ print_track(&alloc_info->alloc_track, "Allocated");
+ print_track(&alloc_info->free_track, "Freed");
+ }
+
+ describe_object_addr(cache, object, addr);
}
void kasan_report_double_free(struct kmem_cache *cache, void *object,
@@ -219,13 +250,13 @@ void kasan_report_double_free(struct kmem_cache *cache, void *object,
pr_err("BUG: Double free or freeing an invalid pointer\n");
pr_err("Unexpected shadow byte: 0x%hhX\n", shadow);
dump_stack();
- describe_object(cache, object);
+ describe_object(cache, object, NULL);
kasan_end_report(&flags);
}
static void print_address_description(struct kasan_access_info *info)
{
- const void *addr = info->access_addr;
+ void *addr = (void *)info->access_addr;
struct page *page = addr_to_page(addr);
if (page)
@@ -235,9 +266,9 @@ static void print_address_description(struct kasan_access_info *info)
if (page && PageSlab(page)) {
struct kmem_cache *cache = page->slab_cache;
- void *object = nearest_obj(cache, page, (void *)addr);
+ void *object = nearest_obj(cache, page, addr);
- describe_object(cache, object);
+ describe_object(cache, object, addr);
}
if (kernel_or_module_addr(addr)) {
--
2.12.0.rc1.440.g5b76565f74-goog
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-03-02 13:49 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-02 13:48 [PATCH v2 0/9] kasan: improve error reports Andrey Konovalov
2017-03-02 13:48 ` [PATCH v2 1/9] kasan: introduce helper functions for determining bug type Andrey Konovalov
2017-03-02 17:19 ` Alexander Potapenko
2017-03-03 13:15 ` Andrey Ryabinin
2017-03-02 13:48 ` [PATCH v2 2/9] kasan: unify report headers Andrey Konovalov
2017-03-02 13:48 ` [PATCH v2 3/9] kasan: change allocation and freeing stack traces headers Andrey Konovalov
2017-03-02 13:48 ` [PATCH v2 4/9] kasan: simplify address description logic Andrey Konovalov
2017-03-03 13:37 ` Andrey Ryabinin
2017-03-02 13:48 ` [PATCH v2 5/9] kasan: change report header Andrey Konovalov
2017-03-03 13:21 ` Andrey Ryabinin
2017-03-03 14:18 ` Andrey Konovalov
2017-03-03 14:18 ` Andrey Konovalov
2017-03-02 13:48 ` Andrey Konovalov [this message]
2017-03-03 13:31 ` [PATCH v2 6/9] kasan: improve slab object description Andrey Ryabinin
2017-03-03 13:52 ` Alexander Potapenko
2017-03-03 14:39 ` Andrey Ryabinin
2017-03-06 13:45 ` Andrey Konovalov
2017-03-06 16:12 ` Andrey Ryabinin
2017-03-06 17:05 ` Andrey Konovalov
2017-03-06 17:16 ` Andrey Konovalov
2017-03-09 12:56 ` Andrey Ryabinin
2017-03-14 17:15 ` Andrey Konovalov
2017-03-20 15:39 ` Andrey Ryabinin
2017-03-24 19:31 ` Andrey Konovalov
2017-03-02 13:48 ` [PATCH v2 7/9] kasan: print page description after stacks Andrey Konovalov
2017-03-02 13:48 ` [PATCH v2 8/9] kasan: improve double-free report format Andrey Konovalov
2017-03-02 13:48 ` [PATCH v2 9/9] kasan: separate report parts by empty lines Andrey Konovalov
2017-03-02 13:57 ` [PATCH v2 0/9] kasan: improve error reports Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170302134851.101218-7-andreyknvl@google.com \
--to=andreyknvl@google.com \
--cc=aryabinin@virtuozzo.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).