io_uring: fix infinite wait in khread_park() on io_finish_async()
[linux-2.6-block.git] / lib / ubsan.c
CommitLineData
c6d30853
AR
1/*
2 * UBSAN error reporting functions
3 *
4 * Copyright (c) 2014 Samsung Electronics Co., Ltd.
5 * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 */
12
13#include <linux/bitops.h>
14#include <linux/bug.h>
15#include <linux/ctype.h>
16#include <linux/init.h>
17#include <linux/kernel.h>
18#include <linux/types.h>
19#include <linux/sched.h>
d08965a2 20#include <linux/uaccess.h>
c6d30853
AR
21
22#include "ubsan.h"
23
24const char *type_check_kinds[] = {
25 "load of",
26 "store to",
27 "reference binding to",
28 "member access within",
29 "member call on",
30 "constructor call on",
31 "downcast of",
32 "downcast of"
33};
34
35#define REPORTED_BIT 31
36
37#if (BITS_PER_LONG == 64) && defined(__BIG_ENDIAN)
38#define COLUMN_MASK (~(1U << REPORTED_BIT))
39#define LINE_MASK (~0U)
40#else
41#define COLUMN_MASK (~0U)
42#define LINE_MASK (~(1U << REPORTED_BIT))
43#endif
44
45#define VALUE_LENGTH 40
46
47static bool was_reported(struct source_location *location)
48{
49 return test_and_set_bit(REPORTED_BIT, &location->reported);
50}
51
52static void print_source_location(const char *prefix,
53 struct source_location *loc)
54{
55 pr_err("%s %s:%d:%d\n", prefix, loc->file_name,
56 loc->line & LINE_MASK, loc->column & COLUMN_MASK);
57}
58
59static bool suppress_report(struct source_location *loc)
60{
61 return current->in_ubsan || was_reported(loc);
62}
63
64static bool type_is_int(struct type_descriptor *type)
65{
66 return type->type_kind == type_kind_int;
67}
68
69static bool type_is_signed(struct type_descriptor *type)
70{
71 WARN_ON(!type_is_int(type));
72 return type->type_info & 1;
73}
74
75static unsigned type_bit_width(struct type_descriptor *type)
76{
77 return 1 << (type->type_info >> 1);
78}
79
80static bool is_inline_int(struct type_descriptor *type)
81{
82 unsigned inline_bits = sizeof(unsigned long)*8;
83 unsigned bits = type_bit_width(type);
84
85 WARN_ON(!type_is_int(type));
86
87 return bits <= inline_bits;
88}
89
f0996bc2 90static s_max get_signed_val(struct type_descriptor *type, void *val)
c6d30853
AR
91{
92 if (is_inline_int(type)) {
93 unsigned extra_bits = sizeof(s_max)*8 - type_bit_width(type);
f0996bc2
AR
94 unsigned long ulong_val = (unsigned long)val;
95
96 return ((s_max)ulong_val) << extra_bits >> extra_bits;
c6d30853
AR
97 }
98
99 if (type_bit_width(type) == 64)
100 return *(s64 *)val;
101
102 return *(s_max *)val;
103}
104
f0996bc2 105static bool val_is_negative(struct type_descriptor *type, void *val)
c6d30853
AR
106{
107 return type_is_signed(type) && get_signed_val(type, val) < 0;
108}
109
f0996bc2 110static u_max get_unsigned_val(struct type_descriptor *type, void *val)
c6d30853
AR
111{
112 if (is_inline_int(type))
f0996bc2 113 return (unsigned long)val;
c6d30853
AR
114
115 if (type_bit_width(type) == 64)
116 return *(u64 *)val;
117
118 return *(u_max *)val;
119}
120
121static void val_to_string(char *str, size_t size, struct type_descriptor *type,
f0996bc2 122 void *value)
c6d30853
AR
123{
124 if (type_is_int(type)) {
125 if (type_bit_width(type) == 128) {
126#if defined(CONFIG_ARCH_SUPPORTS_INT128) && defined(__SIZEOF_INT128__)
127 u_max val = get_unsigned_val(type, value);
128
129 scnprintf(str, size, "0x%08x%08x%08x%08x",
130 (u32)(val >> 96),
131 (u32)(val >> 64),
132 (u32)(val >> 32),
133 (u32)(val));
134#else
135 WARN_ON(1);
136#endif
137 } else if (type_is_signed(type)) {
138 scnprintf(str, size, "%lld",
139 (s64)get_signed_val(type, value));
140 } else {
141 scnprintf(str, size, "%llu",
142 (u64)get_unsigned_val(type, value));
143 }
144 }
145}
146
c6d30853
AR
147static DEFINE_SPINLOCK(report_lock);
148
149static void ubsan_prologue(struct source_location *location,
150 unsigned long *flags)
151{
152 current->in_ubsan++;
153 spin_lock_irqsave(&report_lock, *flags);
154
155 pr_err("========================================"
156 "========================================\n");
157 print_source_location("UBSAN: Undefined behaviour in", location);
158}
159
160static void ubsan_epilogue(unsigned long *flags)
161{
162 dump_stack();
163 pr_err("========================================"
164 "========================================\n");
165 spin_unlock_irqrestore(&report_lock, *flags);
166 current->in_ubsan--;
167}
168
f0996bc2
AR
169static void handle_overflow(struct overflow_data *data, void *lhs,
170 void *rhs, char op)
c6d30853
AR
171{
172
173 struct type_descriptor *type = data->type;
174 unsigned long flags;
175 char lhs_val_str[VALUE_LENGTH];
176 char rhs_val_str[VALUE_LENGTH];
177
178 if (suppress_report(&data->location))
179 return;
180
181 ubsan_prologue(&data->location, &flags);
182
183 val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);
184 val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);
185 pr_err("%s integer overflow:\n",
186 type_is_signed(type) ? "signed" : "unsigned");
187 pr_err("%s %c %s cannot be represented in type %s\n",
188 lhs_val_str,
189 op,
190 rhs_val_str,
191 type->type_name);
192
193 ubsan_epilogue(&flags);
194}
195
196void __ubsan_handle_add_overflow(struct overflow_data *data,
f0996bc2 197 void *lhs, void *rhs)
c6d30853
AR
198{
199
200 handle_overflow(data, lhs, rhs, '+');
201}
202EXPORT_SYMBOL(__ubsan_handle_add_overflow);
203
204void __ubsan_handle_sub_overflow(struct overflow_data *data,
f0996bc2 205 void *lhs, void *rhs)
c6d30853
AR
206{
207 handle_overflow(data, lhs, rhs, '-');
208}
209EXPORT_SYMBOL(__ubsan_handle_sub_overflow);
210
211void __ubsan_handle_mul_overflow(struct overflow_data *data,
f0996bc2 212 void *lhs, void *rhs)
c6d30853
AR
213{
214 handle_overflow(data, lhs, rhs, '*');
215}
216EXPORT_SYMBOL(__ubsan_handle_mul_overflow);
217
218void __ubsan_handle_negate_overflow(struct overflow_data *data,
f0996bc2 219 void *old_val)
c6d30853
AR
220{
221 unsigned long flags;
222 char old_val_str[VALUE_LENGTH];
223
224 if (suppress_report(&data->location))
225 return;
226
227 ubsan_prologue(&data->location, &flags);
228
229 val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
230
231 pr_err("negation of %s cannot be represented in type %s:\n",
232 old_val_str, data->type->type_name);
233
234 ubsan_epilogue(&flags);
235}
236EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
237
238
239void __ubsan_handle_divrem_overflow(struct overflow_data *data,
f0996bc2 240 void *lhs, void *rhs)
c6d30853
AR
241{
242 unsigned long flags;
243 char rhs_val_str[VALUE_LENGTH];
244
245 if (suppress_report(&data->location))
246 return;
247
248 ubsan_prologue(&data->location, &flags);
249
250 val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
251
252 if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1)
253 pr_err("division of %s by -1 cannot be represented in type %s\n",
254 rhs_val_str, data->type->type_name);
255 else
256 pr_err("division by zero\n");
257
258 ubsan_epilogue(&flags);
259}
260EXPORT_SYMBOL(__ubsan_handle_divrem_overflow);
261
42440c1f 262static void handle_null_ptr_deref(struct type_mismatch_data_common *data)
c6d30853
AR
263{
264 unsigned long flags;
265
42440c1f 266 if (suppress_report(data->location))
c6d30853
AR
267 return;
268
42440c1f 269 ubsan_prologue(data->location, &flags);
c6d30853
AR
270
271 pr_err("%s null pointer of type %s\n",
272 type_check_kinds[data->type_check_kind],
273 data->type->type_name);
274
275 ubsan_epilogue(&flags);
276}
277
42440c1f 278static void handle_misaligned_access(struct type_mismatch_data_common *data,
c6d30853
AR
279 unsigned long ptr)
280{
281 unsigned long flags;
282
42440c1f 283 if (suppress_report(data->location))
c6d30853
AR
284 return;
285
42440c1f 286 ubsan_prologue(data->location, &flags);
c6d30853
AR
287
288 pr_err("%s misaligned address %p for type %s\n",
289 type_check_kinds[data->type_check_kind],
290 (void *)ptr, data->type->type_name);
291 pr_err("which requires %ld byte alignment\n", data->alignment);
292
293 ubsan_epilogue(&flags);
294}
295
42440c1f 296static void handle_object_size_mismatch(struct type_mismatch_data_common *data,
c6d30853
AR
297 unsigned long ptr)
298{
299 unsigned long flags;
300
42440c1f 301 if (suppress_report(data->location))
c6d30853
AR
302 return;
303
42440c1f 304 ubsan_prologue(data->location, &flags);
901d805c 305 pr_err("%s address %p with insufficient space\n",
c6d30853
AR
306 type_check_kinds[data->type_check_kind],
307 (void *) ptr);
308 pr_err("for an object of type %s\n", data->type->type_name);
309 ubsan_epilogue(&flags);
310}
311
42440c1f 312static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data,
c6d30853
AR
313 unsigned long ptr)
314{
d08965a2 315 unsigned long flags = user_access_save();
c6d30853
AR
316
317 if (!ptr)
318 handle_null_ptr_deref(data);
319 else if (data->alignment && !IS_ALIGNED(ptr, data->alignment))
b8fe1120 320 handle_misaligned_access(data, ptr);
c6d30853
AR
321 else
322 handle_object_size_mismatch(data, ptr);
d08965a2
PZ
323
324 user_access_restore(flags);
c6d30853 325}
42440c1f
AR
326
327void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
f0996bc2 328 void *ptr)
42440c1f
AR
329{
330 struct type_mismatch_data_common common_data = {
331 .location = &data->location,
332 .type = data->type,
333 .alignment = data->alignment,
334 .type_check_kind = data->type_check_kind
335 };
336
f0996bc2 337 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
42440c1f 338}
c6d30853
AR
339EXPORT_SYMBOL(__ubsan_handle_type_mismatch);
340
42440c1f 341void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data,
f0996bc2 342 void *ptr)
42440c1f
AR
343{
344
345 struct type_mismatch_data_common common_data = {
346 .location = &data->location,
347 .type = data->type,
348 .alignment = 1UL << data->log_alignment,
349 .type_check_kind = data->type_check_kind
350 };
351
f0996bc2 352 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
42440c1f
AR
353}
354EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1);
355
f0996bc2 356void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index)
c6d30853
AR
357{
358 unsigned long flags;
359 char index_str[VALUE_LENGTH];
360
361 if (suppress_report(&data->location))
362 return;
363
364 ubsan_prologue(&data->location, &flags);
365
366 val_to_string(index_str, sizeof(index_str), data->index_type, index);
367 pr_err("index %s is out of range for type %s\n", index_str,
368 data->array_type->type_name);
369 ubsan_epilogue(&flags);
370}
371EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
372
373void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
f0996bc2 374 void *lhs, void *rhs)
c6d30853
AR
375{
376 unsigned long flags;
377 struct type_descriptor *rhs_type = data->rhs_type;
378 struct type_descriptor *lhs_type = data->lhs_type;
379 char rhs_str[VALUE_LENGTH];
380 char lhs_str[VALUE_LENGTH];
381
382 if (suppress_report(&data->location))
383 return;
384
385 ubsan_prologue(&data->location, &flags);
386
387 val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
388 val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
389
390 if (val_is_negative(rhs_type, rhs))
391 pr_err("shift exponent %s is negative\n", rhs_str);
392
393 else if (get_unsigned_val(rhs_type, rhs) >=
394 type_bit_width(lhs_type))
395 pr_err("shift exponent %s is too large for %u-bit type %s\n",
396 rhs_str,
397 type_bit_width(lhs_type),
398 lhs_type->type_name);
399 else if (val_is_negative(lhs_type, lhs))
400 pr_err("left shift of negative value %s\n",
401 lhs_str);
402 else
403 pr_err("left shift of %s by %s places cannot be"
404 " represented in type %s\n",
405 lhs_str, rhs_str,
406 lhs_type->type_name);
407
408 ubsan_epilogue(&flags);
409}
410EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
411
412
1c23b410 413void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
c6d30853
AR
414{
415 unsigned long flags;
416
417 ubsan_prologue(&data->location, &flags);
418 pr_err("calling __builtin_unreachable()\n");
419 ubsan_epilogue(&flags);
420 panic("can't return from __builtin_unreachable()");
421}
422EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
423
424void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
f0996bc2 425 void *val)
c6d30853
AR
426{
427 unsigned long flags;
428 char val_str[VALUE_LENGTH];
429
430 if (suppress_report(&data->location))
431 return;
432
433 ubsan_prologue(&data->location, &flags);
434
435 val_to_string(val_str, sizeof(val_str), data->type, val);
436
437 pr_err("load of value %s is not a valid value for type %s\n",
438 val_str, data->type->type_name);
439
440 ubsan_epilogue(&flags);
441}
442EXPORT_SYMBOL(__ubsan_handle_load_invalid_value);