Commit ef065653 authored by Kees Cook's avatar Kees Cook Committed by Linus Torvalds
Browse files

ubsan: include bug type in report header 



When syzbot tries to figure out how to deduplicate bug reports, it prefers
seeing a hint about a specific bug type (we can do better than just
"UBSAN").  This lifts the handler reason into the UBSAN report line that
includes the file path that tripped a check.  Unfortunately, UBSAN does
not provide function names.

Suggested-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Elena Petrova <lenaptr@google.com>
Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Link: http://lkml.kernel.org/r/20200227193516.32566-7-keescook@chromium.org
Link: https://lore.kernel.org/lkml/CACT4Y+bsLJ-wFx_TaXqax3JByUOWB3uk787LsyMVcfW6JzzGvg@mail.gmail.com


Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 1d2252fa

lib/ubsan.c

+15 −21
Original line number Diff line number Diff line
@@ -45,13 +45,6 @@ static bool was_reported(struct source_location *location) 
	return test_and_set_bit(REPORTED_BIT, &location->reported);

}



static void print_source_location(const char *prefix,

				struct source_location *loc)

{

	pr_err("%s %s:%d:%d\n", prefix, loc->file_name,

		loc->line & LINE_MASK, loc->column & COLUMN_MASK);

}



static bool suppress_report(struct source_location *loc)

{

	return current->in_ubsan || was_reported(loc);
@@ -140,13 +133,14 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type, 
	}

}



static void ubsan_prologue(struct source_location *location)

static void ubsan_prologue(struct source_location *loc, const char *reason)

{

	current->in_ubsan++;



	pr_err("========================================"

		"========================================\n");

	print_source_location("UBSAN: Undefined behaviour in", location);

	pr_err("UBSAN: %s in %s:%d:%d\n", reason, loc->file_name,

		loc->line & LINE_MASK, loc->column & COLUMN_MASK);

}



static void ubsan_epilogue(void)
@@ -180,12 +174,12 @@ static void handle_overflow(struct overflow_data *data, void *lhs, 
	if (suppress_report(&data->location))

		return;



	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, type_is_signed(type) ?

			"signed-integer-overflow" :

			"unsigned-integer-overflow");



	val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);

	val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);

	pr_err("%s integer overflow:\n",

		type_is_signed(type) ? "signed" : "unsigned");

	pr_err("%s %c %s cannot be represented in type %s\n",

		lhs_val_str,

		op,
@@ -225,7 +219,7 @@ void __ubsan_handle_negate_overflow(struct overflow_data *data, 
	if (suppress_report(&data->location))

		return;



	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, "negation-overflow");



	val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
@@ -245,7 +239,7 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data, 
	if (suppress_report(&data->location))

		return;



	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, "division-overflow");



	val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
@@ -264,7 +258,7 @@ static void handle_null_ptr_deref(struct type_mismatch_data_common *data) 
	if (suppress_report(data->location))

		return;



	ubsan_prologue(data->location);

	ubsan_prologue(data->location, "null-ptr-deref");



	pr_err("%s null pointer of type %s\n",

		type_check_kinds[data->type_check_kind],
@@ -279,7 +273,7 @@ static void handle_misaligned_access(struct type_mismatch_data_common *data, 
	if (suppress_report(data->location))

		return;



	ubsan_prologue(data->location);

	ubsan_prologue(data->location, "misaligned-access");



	pr_err("%s misaligned address %p for type %s\n",

		type_check_kinds[data->type_check_kind],
@@ -295,7 +289,7 @@ static void handle_object_size_mismatch(struct type_mismatch_data_common *data, 
	if (suppress_report(data->location))

		return;



	ubsan_prologue(data->location);

	ubsan_prologue(data->location, "object-size-mismatch");

	pr_err("%s address %p with insufficient space\n",

		type_check_kinds[data->type_check_kind],

		(void *) ptr);
@@ -354,7 +348,7 @@ void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) 
	if (suppress_report(&data->location))

		return;



	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, "array-index-out-of-bounds");



	val_to_string(index_str, sizeof(index_str), data->index_type, index);

	pr_err("index %s is out of range for type %s\n", index_str,
@@ -375,7 +369,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, 
	if (suppress_report(&data->location))

		goto out;



	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, "shift-out-of-bounds");



	val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);

	val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
@@ -407,7 +401,7 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); 


void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)

{

	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, "unreachable");

	pr_err("calling __builtin_unreachable()\n");

	ubsan_epilogue();

	panic("can't return from __builtin_unreachable()");
@@ -422,7 +416,7 @@ void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, 
	if (suppress_report(&data->location))

		return;



	ubsan_prologue(&data->location);

	ubsan_prologue(&data->location, "invalid-load");



	val_to_string(val_str, sizeof(val_str), data->type, val);

CRA Git | Maintained and supported by SUSTech CRA and CCSE