Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 | // SPDX-License-Identifier: GPL-2.0 #include <linux/kernel.h> #include <linux/string.h> #include <linux/mm.h> #include <linux/highmem.h> #include <linux/page_ext.h> #include <linux/poison.h> #include <linux/ratelimit.h> #include <linux/kasan.h> static DEFINE_STATIC_KEY_FALSE_RO(want_page_poisoning); static int __init early_page_poison_param(char *buf) { int ret; bool tmp; ret = strtobool(buf, &tmp); if (ret) return ret; if (tmp) static_branch_enable(&want_page_poisoning); else static_branch_disable(&want_page_poisoning); return 0; } early_param("page_poison", early_page_poison_param); /** * page_poisoning_enabled - check if page poisoning is enabled * * Return true if page poisoning is enabled, or false if not. */ bool page_poisoning_enabled(void) { /* * Assumes that debug_pagealloc_enabled is set before * memblock_free_all. * Page poisoning is debug page alloc for some arches. If * either of those options are enabled, enable poisoning. */ return (static_branch_unlikely(&want_page_poisoning) || (!IS_ENABLED(CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC) && debug_pagealloc_enabled())); } EXPORT_SYMBOL_GPL(page_poisoning_enabled); static void poison_page(struct page *page) { void *addr = kmap_atomic(page); /* KASAN still think the page is in-use, so skip it. */ kasan_disable_current(); memset(addr, PAGE_POISON, PAGE_SIZE); kasan_enable_current(); kunmap_atomic(addr); } static void poison_pages(struct page *page, int n) { int i; for (i = 0; i < n; i++) poison_page(page + i); } static bool single_bit_flip(unsigned char a, unsigned char b) { unsigned char error = a ^ b; return error && !(error & (error - 1)); } static void check_poison_mem(unsigned char *mem, size_t bytes) { static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 10); unsigned char *start; unsigned char *end; if (IS_ENABLED(CONFIG_PAGE_POISONING_NO_SANITY)) return; start = memchr_inv(mem, PAGE_POISON, bytes); if (!start) return; for (end = mem + bytes - 1; end > start; end--) { if (*end != PAGE_POISON) break; } if (!__ratelimit(&ratelimit)) return; else if (start == end && single_bit_flip(*start, PAGE_POISON)) pr_err("pagealloc: single bit error\n"); else pr_err("pagealloc: memory corruption\n"); print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, start, end - start + 1, 1); dump_stack(); } static void unpoison_page(struct page *page) { void *addr; addr = kmap_atomic(page); /* * Page poisoning when enabled poisons each and every page * that is freed to buddy. Thus no extra check is done to * see if a page was poisoned. */ check_poison_mem(addr, PAGE_SIZE); kunmap_atomic(addr); } static void unpoison_pages(struct page *page, int n) { int i; for (i = 0; i < n; i++) unpoison_page(page + i); } void kernel_poison_pages(struct page *page, int numpages, int enable) { if (!page_poisoning_enabled()) return; if (enable) unpoison_pages(page, numpages); else poison_pages(page, numpages); } #ifndef CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC void __kernel_map_pages(struct page *page, int numpages, int enable) { /* This function does nothing, all work is done via poison pages */ } #endif |