1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _LINUX_KASAN_H
3 #define _LINUX_KASAN_H
4
5 #include <linux/bug.h>
6 #include <linux/kasan-enabled.h>
7 #include <linux/kernel.h>
8 #include <linux/static_key.h>
9 #include <linux/types.h>
10
11 struct kmem_cache;
12 struct page;
13 struct slab;
14 struct vm_struct;
15 struct task_struct;
16
17 #ifdef CONFIG_KASAN
18
19 #include <linux/linkage.h>
20 #include <asm/kasan.h>
21
22 #endif
23
24 typedef unsigned int __bitwise kasan_vmalloc_flags_t;
25
26 #define KASAN_VMALLOC_NONE ((__force kasan_vmalloc_flags_t)0x00u)
27 #define KASAN_VMALLOC_INIT ((__force kasan_vmalloc_flags_t)0x01u)
28 #define KASAN_VMALLOC_VM_ALLOC ((__force kasan_vmalloc_flags_t)0x02u)
29 #define KASAN_VMALLOC_PROT_NORMAL ((__force kasan_vmalloc_flags_t)0x04u)
30
31 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
32
33 #include <linux/pgtable.h>
34
35 /* Software KASAN implementations use shadow memory. */
36
37 #ifdef CONFIG_KASAN_SW_TAGS
38 /* This matches KASAN_TAG_INVALID. */
39 #define KASAN_SHADOW_INIT 0xFE
40 #else
41 #define KASAN_SHADOW_INIT 0
42 #endif
43
44 #ifndef PTE_HWTABLE_PTRS
45 #define PTE_HWTABLE_PTRS 0
46 #endif
47
48 extern unsigned char kasan_early_shadow_page[PAGE_SIZE];
49 extern pte_t kasan_early_shadow_pte[MAX_PTRS_PER_PTE + PTE_HWTABLE_PTRS];
50 extern pmd_t kasan_early_shadow_pmd[MAX_PTRS_PER_PMD];
51 extern pud_t kasan_early_shadow_pud[MAX_PTRS_PER_PUD];
52 extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D];
53
54 int kasan_populate_early_shadow(const void *shadow_start,
55 const void *shadow_end);
56
kasan_mem_to_shadow(const void * addr)57 static inline void *kasan_mem_to_shadow(const void *addr)
58 {
59 return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT)
60 + KASAN_SHADOW_OFFSET;
61 }
62
63 int kasan_add_zero_shadow(void *start, unsigned long size);
64 void kasan_remove_zero_shadow(void *start, unsigned long size);
65
66 /* Enable reporting bugs after kasan_disable_current() */
67 extern void kasan_enable_current(void);
68
69 /* Disable reporting bugs for current task */
70 extern void kasan_disable_current(void);
71
72 #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
73
kasan_add_zero_shadow(void * start,unsigned long size)74 static inline int kasan_add_zero_shadow(void *start, unsigned long size)
75 {
76 return 0;
77 }
kasan_remove_zero_shadow(void * start,unsigned long size)78 static inline void kasan_remove_zero_shadow(void *start,
79 unsigned long size)
80 {}
81
kasan_enable_current(void)82 static inline void kasan_enable_current(void) {}
kasan_disable_current(void)83 static inline void kasan_disable_current(void) {}
84
85 #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
86
87 #ifdef CONFIG_KASAN_HW_TAGS
88
89 #else /* CONFIG_KASAN_HW_TAGS */
90
91 #endif /* CONFIG_KASAN_HW_TAGS */
92
kasan_has_integrated_init(void)93 static inline bool kasan_has_integrated_init(void)
94 {
95 return kasan_hw_tags_enabled();
96 }
97
98 #ifdef CONFIG_KASAN
99
100 struct kasan_cache {
101 #ifdef CONFIG_KASAN_GENERIC
102 int alloc_meta_offset;
103 int free_meta_offset;
104 #endif
105 bool is_kmalloc;
106 };
107
108 void __kasan_unpoison_range(const void *addr, size_t size);
kasan_unpoison_range(const void * addr,size_t size)109 static __always_inline void kasan_unpoison_range(const void *addr, size_t size)
110 {
111 if (kasan_enabled())
112 __kasan_unpoison_range(addr, size);
113 }
114
115 void __kasan_poison_pages(struct page *page, unsigned int order, bool init);
kasan_poison_pages(struct page * page,unsigned int order,bool init)116 static __always_inline void kasan_poison_pages(struct page *page,
117 unsigned int order, bool init)
118 {
119 if (kasan_enabled())
120 __kasan_poison_pages(page, order, init);
121 }
122
123 bool __kasan_unpoison_pages(struct page *page, unsigned int order, bool init);
kasan_unpoison_pages(struct page * page,unsigned int order,bool init)124 static __always_inline bool kasan_unpoison_pages(struct page *page,
125 unsigned int order, bool init)
126 {
127 if (kasan_enabled())
128 return __kasan_unpoison_pages(page, order, init);
129 return false;
130 }
131
132 void __kasan_cache_create_kmalloc(struct kmem_cache *cache);
kasan_cache_create_kmalloc(struct kmem_cache * cache)133 static __always_inline void kasan_cache_create_kmalloc(struct kmem_cache *cache)
134 {
135 if (kasan_enabled())
136 __kasan_cache_create_kmalloc(cache);
137 }
138
139 void __kasan_poison_slab(struct slab *slab);
kasan_poison_slab(struct slab * slab)140 static __always_inline void kasan_poison_slab(struct slab *slab)
141 {
142 if (kasan_enabled())
143 __kasan_poison_slab(slab);
144 }
145
146 void __kasan_unpoison_object_data(struct kmem_cache *cache, void *object);
kasan_unpoison_object_data(struct kmem_cache * cache,void * object)147 static __always_inline void kasan_unpoison_object_data(struct kmem_cache *cache,
148 void *object)
149 {
150 if (kasan_enabled())
151 __kasan_unpoison_object_data(cache, object);
152 }
153
154 void __kasan_poison_object_data(struct kmem_cache *cache, void *object);
kasan_poison_object_data(struct kmem_cache * cache,void * object)155 static __always_inline void kasan_poison_object_data(struct kmem_cache *cache,
156 void *object)
157 {
158 if (kasan_enabled())
159 __kasan_poison_object_data(cache, object);
160 }
161
162 void * __must_check __kasan_init_slab_obj(struct kmem_cache *cache,
163 const void *object);
kasan_init_slab_obj(struct kmem_cache * cache,const void * object)164 static __always_inline void * __must_check kasan_init_slab_obj(
165 struct kmem_cache *cache, const void *object)
166 {
167 if (kasan_enabled())
168 return __kasan_init_slab_obj(cache, object);
169 return (void *)object;
170 }
171
172 bool __kasan_slab_free(struct kmem_cache *s, void *object,
173 unsigned long ip, bool init);
kasan_slab_free(struct kmem_cache * s,void * object,bool init)174 static __always_inline bool kasan_slab_free(struct kmem_cache *s,
175 void *object, bool init)
176 {
177 if (kasan_enabled())
178 return __kasan_slab_free(s, object, _RET_IP_, init);
179 return false;
180 }
181
182 void __kasan_kfree_large(void *ptr, unsigned long ip);
kasan_kfree_large(void * ptr)183 static __always_inline void kasan_kfree_large(void *ptr)
184 {
185 if (kasan_enabled())
186 __kasan_kfree_large(ptr, _RET_IP_);
187 }
188
189 void __kasan_slab_free_mempool(void *ptr, unsigned long ip);
kasan_slab_free_mempool(void * ptr)190 static __always_inline void kasan_slab_free_mempool(void *ptr)
191 {
192 if (kasan_enabled())
193 __kasan_slab_free_mempool(ptr, _RET_IP_);
194 }
195
196 void * __must_check __kasan_slab_alloc(struct kmem_cache *s,
197 void *object, gfp_t flags, bool init);
kasan_slab_alloc(struct kmem_cache * s,void * object,gfp_t flags,bool init)198 static __always_inline void * __must_check kasan_slab_alloc(
199 struct kmem_cache *s, void *object, gfp_t flags, bool init)
200 {
201 if (kasan_enabled())
202 return __kasan_slab_alloc(s, object, flags, init);
203 return object;
204 }
205
206 void * __must_check __kasan_kmalloc(struct kmem_cache *s, const void *object,
207 size_t size, gfp_t flags);
kasan_kmalloc(struct kmem_cache * s,const void * object,size_t size,gfp_t flags)208 static __always_inline void * __must_check kasan_kmalloc(struct kmem_cache *s,
209 const void *object, size_t size, gfp_t flags)
210 {
211 if (kasan_enabled())
212 return __kasan_kmalloc(s, object, size, flags);
213 return (void *)object;
214 }
215
216 void * __must_check __kasan_kmalloc_large(const void *ptr,
217 size_t size, gfp_t flags);
kasan_kmalloc_large(const void * ptr,size_t size,gfp_t flags)218 static __always_inline void * __must_check kasan_kmalloc_large(const void *ptr,
219 size_t size, gfp_t flags)
220 {
221 if (kasan_enabled())
222 return __kasan_kmalloc_large(ptr, size, flags);
223 return (void *)ptr;
224 }
225
226 void * __must_check __kasan_krealloc(const void *object,
227 size_t new_size, gfp_t flags);
kasan_krealloc(const void * object,size_t new_size,gfp_t flags)228 static __always_inline void * __must_check kasan_krealloc(const void *object,
229 size_t new_size, gfp_t flags)
230 {
231 if (kasan_enabled())
232 return __kasan_krealloc(object, new_size, flags);
233 return (void *)object;
234 }
235
236 /*
237 * Unlike kasan_check_read/write(), kasan_check_byte() is performed even for
238 * the hardware tag-based mode that doesn't rely on compiler instrumentation.
239 */
240 bool __kasan_check_byte(const void *addr, unsigned long ip);
kasan_check_byte(const void * addr)241 static __always_inline bool kasan_check_byte(const void *addr)
242 {
243 if (kasan_enabled())
244 return __kasan_check_byte(addr, _RET_IP_);
245 return true;
246 }
247
248 #else /* CONFIG_KASAN */
249
kasan_unpoison_range(const void * address,size_t size)250 static inline void kasan_unpoison_range(const void *address, size_t size) {}
kasan_poison_pages(struct page * page,unsigned int order,bool init)251 static inline void kasan_poison_pages(struct page *page, unsigned int order,
252 bool init) {}
kasan_unpoison_pages(struct page * page,unsigned int order,bool init)253 static inline bool kasan_unpoison_pages(struct page *page, unsigned int order,
254 bool init)
255 {
256 return false;
257 }
kasan_cache_create_kmalloc(struct kmem_cache * cache)258 static inline void kasan_cache_create_kmalloc(struct kmem_cache *cache) {}
kasan_poison_slab(struct slab * slab)259 static inline void kasan_poison_slab(struct slab *slab) {}
kasan_unpoison_object_data(struct kmem_cache * cache,void * object)260 static inline void kasan_unpoison_object_data(struct kmem_cache *cache,
261 void *object) {}
kasan_poison_object_data(struct kmem_cache * cache,void * object)262 static inline void kasan_poison_object_data(struct kmem_cache *cache,
263 void *object) {}
kasan_init_slab_obj(struct kmem_cache * cache,const void * object)264 static inline void *kasan_init_slab_obj(struct kmem_cache *cache,
265 const void *object)
266 {
267 return (void *)object;
268 }
kasan_slab_free(struct kmem_cache * s,void * object,bool init)269 static inline bool kasan_slab_free(struct kmem_cache *s, void *object, bool init)
270 {
271 return false;
272 }
kasan_kfree_large(void * ptr)273 static inline void kasan_kfree_large(void *ptr) {}
kasan_slab_free_mempool(void * ptr)274 static inline void kasan_slab_free_mempool(void *ptr) {}
kasan_slab_alloc(struct kmem_cache * s,void * object,gfp_t flags,bool init)275 static inline void *kasan_slab_alloc(struct kmem_cache *s, void *object,
276 gfp_t flags, bool init)
277 {
278 return object;
279 }
kasan_kmalloc(struct kmem_cache * s,const void * object,size_t size,gfp_t flags)280 static inline void *kasan_kmalloc(struct kmem_cache *s, const void *object,
281 size_t size, gfp_t flags)
282 {
283 return (void *)object;
284 }
kasan_kmalloc_large(const void * ptr,size_t size,gfp_t flags)285 static inline void *kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
286 {
287 return (void *)ptr;
288 }
kasan_krealloc(const void * object,size_t new_size,gfp_t flags)289 static inline void *kasan_krealloc(const void *object, size_t new_size,
290 gfp_t flags)
291 {
292 return (void *)object;
293 }
kasan_check_byte(const void * address)294 static inline bool kasan_check_byte(const void *address)
295 {
296 return true;
297 }
298
299 #endif /* CONFIG_KASAN */
300
301 #if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK)
302 void kasan_unpoison_task_stack(struct task_struct *task);
303 #else
kasan_unpoison_task_stack(struct task_struct * task)304 static inline void kasan_unpoison_task_stack(struct task_struct *task) {}
305 #endif
306
307 #ifdef CONFIG_KASAN_GENERIC
308
309 size_t kasan_metadata_size(struct kmem_cache *cache);
310 slab_flags_t kasan_never_merge(void);
311 void kasan_cache_create(struct kmem_cache *cache, unsigned int *size,
312 slab_flags_t *flags);
313
314 void kasan_cache_shrink(struct kmem_cache *cache);
315 void kasan_cache_shutdown(struct kmem_cache *cache);
316 void kasan_record_aux_stack(void *ptr);
317 void kasan_record_aux_stack_noalloc(void *ptr);
318
319 #else /* CONFIG_KASAN_GENERIC */
320
321 /* Tag-based KASAN modes do not use per-object metadata. */
kasan_metadata_size(struct kmem_cache * cache)322 static inline size_t kasan_metadata_size(struct kmem_cache *cache)
323 {
324 return 0;
325 }
326 /* And thus nothing prevents cache merging. */
kasan_never_merge(void)327 static inline slab_flags_t kasan_never_merge(void)
328 {
329 return 0;
330 }
331 /* And no cache-related metadata initialization is required. */
kasan_cache_create(struct kmem_cache * cache,unsigned int * size,slab_flags_t * flags)332 static inline void kasan_cache_create(struct kmem_cache *cache,
333 unsigned int *size,
334 slab_flags_t *flags) {}
335
kasan_cache_shrink(struct kmem_cache * cache)336 static inline void kasan_cache_shrink(struct kmem_cache *cache) {}
kasan_cache_shutdown(struct kmem_cache * cache)337 static inline void kasan_cache_shutdown(struct kmem_cache *cache) {}
kasan_record_aux_stack(void * ptr)338 static inline void kasan_record_aux_stack(void *ptr) {}
kasan_record_aux_stack_noalloc(void * ptr)339 static inline void kasan_record_aux_stack_noalloc(void *ptr) {}
340
341 #endif /* CONFIG_KASAN_GENERIC */
342
343 #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS)
344
kasan_reset_tag(const void * addr)345 static inline void *kasan_reset_tag(const void *addr)
346 {
347 return (void *)arch_kasan_reset_tag(addr);
348 }
349
350 /**
351 * kasan_report - print a report about a bad memory access detected by KASAN
352 * @addr: address of the bad access
353 * @size: size of the bad access
354 * @is_write: whether the bad access is a write or a read
355 * @ip: instruction pointer for the accessibility check or the bad access itself
356 */
357 bool kasan_report(unsigned long addr, size_t size,
358 bool is_write, unsigned long ip);
359
360 #else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */
361
kasan_reset_tag(const void * addr)362 static inline void *kasan_reset_tag(const void *addr)
363 {
364 return (void *)addr;
365 }
366
367 #endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/
368
369 #ifdef CONFIG_KASAN_HW_TAGS
370
371 void kasan_report_async(void);
372
373 #endif /* CONFIG_KASAN_HW_TAGS */
374
375 #ifdef CONFIG_KASAN_SW_TAGS
376 void __init kasan_init_sw_tags(void);
377 #else
kasan_init_sw_tags(void)378 static inline void kasan_init_sw_tags(void) { }
379 #endif
380
381 #ifdef CONFIG_KASAN_HW_TAGS
382 void kasan_init_hw_tags_cpu(void);
383 void __init kasan_init_hw_tags(void);
384 #else
kasan_init_hw_tags_cpu(void)385 static inline void kasan_init_hw_tags_cpu(void) { }
kasan_init_hw_tags(void)386 static inline void kasan_init_hw_tags(void) { }
387 #endif
388
389 #ifdef CONFIG_KASAN_VMALLOC
390
391 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
392
393 void kasan_populate_early_vm_area_shadow(void *start, unsigned long size);
394 int kasan_populate_vmalloc(unsigned long addr, unsigned long size);
395 void kasan_release_vmalloc(unsigned long start, unsigned long end,
396 unsigned long free_region_start,
397 unsigned long free_region_end);
398
399 #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
400
kasan_populate_early_vm_area_shadow(void * start,unsigned long size)401 static inline void kasan_populate_early_vm_area_shadow(void *start,
402 unsigned long size)
403 { }
kasan_populate_vmalloc(unsigned long start,unsigned long size)404 static inline int kasan_populate_vmalloc(unsigned long start,
405 unsigned long size)
406 {
407 return 0;
408 }
kasan_release_vmalloc(unsigned long start,unsigned long end,unsigned long free_region_start,unsigned long free_region_end)409 static inline void kasan_release_vmalloc(unsigned long start,
410 unsigned long end,
411 unsigned long free_region_start,
412 unsigned long free_region_end) { }
413
414 #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
415
416 void *__kasan_unpoison_vmalloc(const void *start, unsigned long size,
417 kasan_vmalloc_flags_t flags);
kasan_unpoison_vmalloc(const void * start,unsigned long size,kasan_vmalloc_flags_t flags)418 static __always_inline void *kasan_unpoison_vmalloc(const void *start,
419 unsigned long size,
420 kasan_vmalloc_flags_t flags)
421 {
422 if (kasan_enabled())
423 return __kasan_unpoison_vmalloc(start, size, flags);
424 return (void *)start;
425 }
426
427 void __kasan_poison_vmalloc(const void *start, unsigned long size);
kasan_poison_vmalloc(const void * start,unsigned long size)428 static __always_inline void kasan_poison_vmalloc(const void *start,
429 unsigned long size)
430 {
431 if (kasan_enabled())
432 __kasan_poison_vmalloc(start, size);
433 }
434
435 #else /* CONFIG_KASAN_VMALLOC */
436
kasan_populate_early_vm_area_shadow(void * start,unsigned long size)437 static inline void kasan_populate_early_vm_area_shadow(void *start,
438 unsigned long size) { }
kasan_populate_vmalloc(unsigned long start,unsigned long size)439 static inline int kasan_populate_vmalloc(unsigned long start,
440 unsigned long size)
441 {
442 return 0;
443 }
kasan_release_vmalloc(unsigned long start,unsigned long end,unsigned long free_region_start,unsigned long free_region_end)444 static inline void kasan_release_vmalloc(unsigned long start,
445 unsigned long end,
446 unsigned long free_region_start,
447 unsigned long free_region_end) { }
448
kasan_unpoison_vmalloc(const void * start,unsigned long size,kasan_vmalloc_flags_t flags)449 static inline void *kasan_unpoison_vmalloc(const void *start,
450 unsigned long size,
451 kasan_vmalloc_flags_t flags)
452 {
453 return (void *)start;
454 }
kasan_poison_vmalloc(const void * start,unsigned long size)455 static inline void kasan_poison_vmalloc(const void *start, unsigned long size)
456 { }
457
458 #endif /* CONFIG_KASAN_VMALLOC */
459
460 #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \
461 !defined(CONFIG_KASAN_VMALLOC)
462
463 /*
464 * These functions allocate and free shadow memory for kernel modules.
465 * They are only required when KASAN_VMALLOC is not supported, as otherwise
466 * shadow memory is allocated by the generic vmalloc handlers.
467 */
468 int kasan_alloc_module_shadow(void *addr, size_t size, gfp_t gfp_mask);
469 void kasan_free_module_shadow(const struct vm_struct *vm);
470
471 #else /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */
472
kasan_alloc_module_shadow(void * addr,size_t size,gfp_t gfp_mask)473 static inline int kasan_alloc_module_shadow(void *addr, size_t size, gfp_t gfp_mask) { return 0; }
kasan_free_module_shadow(const struct vm_struct * vm)474 static inline void kasan_free_module_shadow(const struct vm_struct *vm) {}
475
476 #endif /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */
477
478 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
479 void kasan_non_canonical_hook(unsigned long addr);
480 #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
kasan_non_canonical_hook(unsigned long addr)481 static inline void kasan_non_canonical_hook(unsigned long addr) { }
482 #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
483
484 #endif /* LINUX_KASAN_H */
485