From patchwork Fri Mar 12 14:24:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 12134791 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC08AC433E0 for ; Fri, 12 Mar 2021 14:24:49 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8B07364FC3 for ; Fri, 12 Mar 2021 14:24:49 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8B07364FC3 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2C1418D035F; Fri, 12 Mar 2021 09:24:49 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 27FD28D035E; Fri, 12 Mar 2021 09:24:49 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 137B78D035E; Fri, 12 Mar 2021 09:24:49 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0213.hostedemail.com [216.40.44.213]) by kanga.kvack.org (Postfix) with ESMTP id E78CB8D0346 for ; Fri, 12 Mar 2021 09:24:48 -0500 (EST) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 0088381CC for ; Fri, 12 Mar 2021 14:24:47 +0000 (UTC) X-FDA: 77911443456.18.BF8D3CD Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) by imf17.hostedemail.com (Postfix) with ESMTP id B7D3F40001DE for ; Fri, 12 Mar 2021 14:24:45 +0000 (UTC) Received: by mail-wm1-f74.google.com with SMTP id m17so2103867wml.3 for ; Fri, 12 Mar 2021 06:24:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=0tHYzYXuuuKT6r1BbOh9jnZkvIRx4Zusj9wo+yaKFLc=; b=sNp2DgDmylfnS/Ht/6f++D6EQH9D86XWw0M6iwarW68/F2DW3jJ2h1ksTDPv3+/C87 pHHYdYTwSOZDZjMyEBULBU3suACHGMtTYH+xUFvBQeSNvTX9u3GDd7/iCHmjVjv2oVGP d9ID8wr2BDrtrTAySXF+Y+WnlUlluKg7uZ6kVckHBZmDAAjE7wjwmqulaTSlQTXX7Qnn 2wZltVoSlSUohS/adb26/ByRLH5goLNkjBZYV5ddzvTVOlzN9fb1BYBCDYUUxR0a0ynv cxoDzqrQv+n3qwNxzHuWgzmpGozNfTqC8HnfSYaC7PGEqZ4ZPv1lDOUdpNuzcd9cdWvo jIAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=0tHYzYXuuuKT6r1BbOh9jnZkvIRx4Zusj9wo+yaKFLc=; b=KOdlxZau/+W31gvkebkK72HJwJPW0iTOpK+fQx/HprWoCuaHSmKJiWbXdQFQwCE546 KY+z4ZGgy+0AF9wrU8V/vgBoYxj9OZh4LOeSzkcZ/f4nWj2qNu9BFksalMT8moy5pL39 thD1PiXtusmpMclmYS5aYHFzrd68OyLnpWQJZnd7LBqBcr7BJcAnF/TCsjtHNFAPiMIH ZpJkjIxIcr/wOyn6XE3OB16JhBPocichQ+Bj79ITOfxJzDgs4lMf3gIz03IJbTOP4Hqc B3FB6zDguR6NasLdmGUQ6oIS2gp2K5OwPY2sQtwlrYoaQ6u6IZrSPOhSlpCebg0LoKwA 87Kw== X-Gm-Message-State: AOAM530TeJyKgUkTe9/deUuUyGq8jzS2d98UxcFY3vviQVl6IPb9Ou/d p5Jcc6Y0Sh+03ZgRLRIl1hlKbKu80iHuUXiF X-Google-Smtp-Source: ABdhPJwdQSHPjvRDAQY5lwOlRkmuLODK/9QSFnR3qAqJKcfl49OirF7C7hzxiTfnjTq8ZyWFvU3BH/BT9cVzEaqw X-Received: from andreyknvl3.muc.corp.google.com ([2a00:79e0:15:13:95a:d8a8:4925:42be]) (user=andreyknvl job=sendgmr) by 2002:a1c:4145:: with SMTP id o66mr8525472wma.68.1615559085218; Fri, 12 Mar 2021 06:24:45 -0800 (PST) Date: Fri, 12 Mar 2021 15:24:27 +0100 In-Reply-To: Message-Id: <3531e8fe6972cf39d1954e3643237b19eb21227e.1615559068.git.andreyknvl@google.com> Mime-Version: 1.0 References: X-Mailer: git-send-email 2.31.0.rc2.261.g7f71774620-goog Subject: [PATCH v2 04/11] kasan: docs: update error reports section From: Andrey Konovalov To: Andrew Morton , Alexander Potapenko , Marco Elver Cc: Andrey Ryabinin , Dmitry Vyukov , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov X-Stat-Signature: y3ix4akfhuq351aaxw77c5iercqhuodq X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: B7D3F40001DE Received-SPF: none (flex--andreyknvl.bounces.google.com>: No applicable sender policy available) receiver=imf17; identity=mailfrom; envelope-from="<3rXlLYAoKCNY2F5J6QCFND8GG8D6.4GEDAFMP-EECN24C.GJ8@flex--andreyknvl.bounces.google.com>"; helo=mail-wm1-f74.google.com; client-ip=209.85.128.74 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1615559085-766346 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Update the "Error reports" section in KASAN documentation: - Mention that bug titles are best-effort. - Move and reword the part about auxiliary stacks from "Implementation details". - Punctuation, readability, and other minor clean-ups. Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver --- Documentation/dev-tools/kasan.rst | 46 +++++++++++++++++-------------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst index 46f4e9680805..cd12c890b888 100644 --- a/Documentation/dev-tools/kasan.rst +++ b/Documentation/dev-tools/kasan.rst @@ -60,7 +60,7 @@ physical pages, enable ``CONFIG_PAGE_OWNER`` and boot with ``page_owner=on``. Error reports ~~~~~~~~~~~~~ -A typical out-of-bounds access generic KASAN report looks like this:: +A typical KASAN report looks like this:: ================================================================== BUG: KASAN: slab-out-of-bounds in kmalloc_oob_right+0xa8/0xbc [test_kasan] @@ -133,33 +133,43 @@ A typical out-of-bounds access generic KASAN report looks like this:: ffff8801f44ec400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== -The header of the report provides a short summary of what kind of bug happened -and what kind of access caused it. It's followed by a stack trace of the bad -access, a stack trace of where the accessed memory was allocated (in case bad -access happens on a slab object), and a stack trace of where the object was -freed (in case of a use-after-free bug report). Next comes a description of -the accessed slab object and information about the accessed memory page. +The report header summarizes what kind of bug happened and what kind of access +caused it. It is followed by a stack trace of the bad access, a stack trace of +where the accessed memory was allocated (in case a slab object was accessed), +and a stack trace of where the object was freed (in case of a use-after-free +bug report). Next comes a description of the accessed slab object and the +information about the accessed memory page. -In the last section the report shows memory state around the accessed address. -Internally KASAN tracks memory state separately for each memory granule, which +In the end, the report shows the memory state around the accessed address. +Internally, KASAN tracks memory state separately for each memory granule, which is either 8 or 16 aligned bytes depending on KASAN mode. Each number in the memory state section of the report shows the state of one of the memory granules that surround the accessed address. -For generic KASAN the size of each memory granule is 8. The state of each +For generic KASAN, the size of each memory granule is 8. The state of each granule is encoded in one shadow byte. Those 8 bytes can be accessible, -partially accessible, freed or be a part of a redzone. KASAN uses the following -encoding for each shadow byte: 0 means that all 8 bytes of the corresponding +partially accessible, freed, or be a part of a redzone. KASAN uses the following +encoding for each shadow byte: 00 means that all 8 bytes of the corresponding memory region are accessible; number N (1 <= N <= 7) means that the first N bytes are accessible, and other (8 - N) bytes are not; any negative value indicates that the entire 8-byte word is inaccessible. KASAN uses different negative values to distinguish between different kinds of inaccessible memory like redzones or freed memory (see mm/kasan/kasan.h). -In the report above the arrows point to the shadow byte 03, which means that -the accessed address is partially accessible. For tag-based KASAN modes this -last report section shows the memory tags around the accessed address -(see the `Implementation details`_ section). +In the report above, the arrow points to the shadow byte ``03``, which means +that the accessed address is partially accessible. + +For tag-based KASAN modes, this last report section shows the memory tags around +the accessed address (see the `Implementation details`_ section). + +Note that KASAN bug titles (like ``slab-out-of-bounds`` or ``use-after-free``) +are best-effort: KASAN prints the most probable bug type based on the limited +information it has. The actual type of the bug might be different. + +Generic KASAN also reports up to two auxiliary call stack traces. These stack +traces point to places in code that interacted with the object but that are not +directly present in the bad access stack trace. Currently, this includes +call_rcu() and workqueue queuing. Boot parameters ~~~~~~~~~~~~~~~ @@ -214,10 +224,6 @@ function calls GCC directly inserts the code to check the shadow memory. This option significantly enlarges kernel but it gives x1.1-x2 performance boost over outline instrumented kernel. -Generic KASAN also reports the last 2 call stacks to creation of work that -potentially has access to an object. Call stacks for the following are shown: -call_rcu() and workqueue queuing. - Generic KASAN is the only mode that delays the reuse of freed object via quarantine (see mm/kasan/quarantine.c for implementation).