kasan: improve slab object description
Changes slab object description from: Object at ffff880068388540, in cache kmalloc-128 size: 128 to: The buggy address belongs to the object at ffff880068388540 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 123 bytes inside of 128-byte region [ffff880068388540, ffff8800683885c0) Makes it more explanatory and adds information about relative offset of the accessed address to the start of the object. Link: http://lkml.kernel.org/r/20170302134851.101218-7-andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Acked-by: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Alexander Potapenko <glider@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
7f0a84c23b
commit
0c06f1f86c
|
@ -198,20 +198,51 @@ static struct page *addr_to_page(const void *addr)
|
|||
return NULL;
|
||||
}
|
||||
|
||||
static void describe_object(struct kmem_cache *cache, void *object)
|
||||
static void describe_object_addr(struct kmem_cache *cache, void *object,
|
||||
const void *addr)
|
||||
{
|
||||
unsigned long access_addr = (unsigned long)addr;
|
||||
unsigned long object_addr = (unsigned long)object;
|
||||
const char *rel_type;
|
||||
int rel_bytes;
|
||||
|
||||
pr_err("The buggy address belongs to the object at %p\n"
|
||||
" which belongs to the cache %s of size %d\n",
|
||||
object, cache->name, cache->object_size);
|
||||
|
||||
if (!addr)
|
||||
return;
|
||||
|
||||
if (access_addr < object_addr) {
|
||||
rel_type = "to the left";
|
||||
rel_bytes = object_addr - access_addr;
|
||||
} else if (access_addr >= object_addr + cache->object_size) {
|
||||
rel_type = "to the right";
|
||||
rel_bytes = access_addr - (object_addr + cache->object_size);
|
||||
} else {
|
||||
rel_type = "inside";
|
||||
rel_bytes = access_addr - object_addr;
|
||||
}
|
||||
|
||||
pr_err("The buggy address is located %d bytes %s of\n"
|
||||
" %d-byte region [%p, %p)\n",
|
||||
rel_bytes, rel_type, cache->object_size, (void *)object_addr,
|
||||
(void *)(object_addr + cache->object_size));
|
||||
}
|
||||
|
||||
static void describe_object(struct kmem_cache *cache, void *object,
|
||||
const void *addr)
|
||||
{
|
||||
struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
|
||||
|
||||
pr_err("Object at %p, in cache %s size: %d\n", object, cache->name,
|
||||
cache->object_size);
|
||||
|
||||
if (!(cache->flags & SLAB_KASAN))
|
||||
return;
|
||||
|
||||
if (cache->flags & SLAB_KASAN) {
|
||||
print_track(&alloc_info->alloc_track, "Allocated");
|
||||
print_track(&alloc_info->free_track, "Freed");
|
||||
}
|
||||
|
||||
describe_object_addr(cache, object, addr);
|
||||
}
|
||||
|
||||
void kasan_report_double_free(struct kmem_cache *cache, void *object,
|
||||
s8 shadow)
|
||||
{
|
||||
|
@ -221,13 +252,13 @@ void kasan_report_double_free(struct kmem_cache *cache, void *object,
|
|||
pr_err("BUG: Double free or freeing an invalid pointer\n");
|
||||
pr_err("Unexpected shadow byte: 0x%hhX\n", shadow);
|
||||
dump_stack();
|
||||
describe_object(cache, object);
|
||||
describe_object(cache, object, NULL);
|
||||
kasan_end_report(&flags);
|
||||
}
|
||||
|
||||
static void print_address_description(struct kasan_access_info *info)
|
||||
{
|
||||
const void *addr = info->access_addr;
|
||||
void *addr = (void *)info->access_addr;
|
||||
struct page *page = addr_to_page(addr);
|
||||
|
||||
if (page)
|
||||
|
@ -237,9 +268,9 @@ static void print_address_description(struct kasan_access_info *info)
|
|||
|
||||
if (page && PageSlab(page)) {
|
||||
struct kmem_cache *cache = page->slab_cache;
|
||||
void *object = nearest_obj(cache, page, (void *)addr);
|
||||
void *object = nearest_obj(cache, page, addr);
|
||||
|
||||
describe_object(cache, object);
|
||||
describe_object(cache, object, addr);
|
||||
}
|
||||
|
||||
if (kernel_or_module_addr(addr)) {
|
||||
|
|
Loading…
Reference in New Issue