kfence-cron: Minimal script that can be run as a cron job to alert the system administrator of KFENCE reports

kfence-cron

#!/usr/bin/env bash
# SPDX-License-Identifier: Apache-2.0
# Copyright 2024 Google LLC.
# Author: Marco Elver <melver AT kernel.org>
#
# kfence-cron: Minimal script that can be run as a cron job to alert the system
# administrator of KFENCE reports.
#
# Enables KFENCE if not already enabled. If KFENCE is unavailable (or cannot be
# enabled) exits with an error.
#
# Example installation (ensure you receive cron mails):
#
#   sudo install -o root -g root -m 0755 kfence-cron /etc/cron.hourly/kfence-cron
#
# About KFENCE (more details: https://docs.kernel.org/dev-tools/kfence.html):
#   | Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory
#   | safety error detector for the Linux kernel. KFENCE detects heap
#   | out-of-bounds access, use-after-free, and invalid-free errors.

set -ue

readonly KFENCE_SYSFS_SAMPLE_INTERVAL="/sys/module/kfence/parameters/sample_interval"
readonly KFENCE_DEFAULT_SAMPLE_INTERVAL=100
readonly KFENCE_STATS="/sys/kernel/debug/kfence/stats"

if [[ "$(id -u)" != "0" ]]; then
	echo "This script must be run as root!"
	exit 1
fi

die()        { echo "error: ""$@" 1>&2; exit 1; }
check_have() { type -p "$1" &>/dev/null || die "'%s' not found!\n" "$1"; }

check_deps() {
	check_have dmesg
	check_have grep
}

# Tries to enable KFENCE, if not already enabled.
try_enable_or_die() {
	if [[ ! -r "$KFENCE_SYSFS_SAMPLE_INTERVAL" ]]; then
		die "KFENCE is unavailable on your system"
	fi
	local sample_interval="$(< "$KFENCE_SYSFS_SAMPLE_INTERVAL")"
	if (( sample_interval > 0 )); then
		return  # KFENCE is already enabled
	fi
	# Try to enable...
	echo $KFENCE_DEFAULT_SAMPLE_INTERVAL > "$KFENCE_SYSFS_SAMPLE_INTERVAL"
	sample_interval="$(< "$KFENCE_SYSFS_SAMPLE_INTERVAL")"
	if (( !sample_interval )); then
		die "failed to enable KFENCE"
	fi
}

# Return the number of bugs KFENCE has detected.
get_num_bugs() {
	if [[ -r "$KFENCE_STATS" ]]; then
		while read line; do
			if [[ "$line" =~ ^total\ bugs: ]]; then
				echo "${line##*: }"
				break
			fi
		done < "$KFENCE_STATS"
	else
		# debugfs unavailable, fall back to slower checking of dmesg.
		dmesg | grep "BUG: KFENCE" | wc -l
	fi
}

# Checks if KFENCE has detected any errors, and summarizes them; otherwise stays
# silent (so that cron does not spam admins if no reports found).
summarize_reports() {
	local num_bugs="$(get_num_bugs)"
	if (( ! num_bugs )); then
		exit 0  # no bugs to report
	fi

	echo "KFENCE has detected $num_bugs bug(s)"
	echo "============================="
	dmesg | grep "BUG: KFENCE" |
	(
		idx=0
		while read line; do
			printf -- "%2d: %s\n" "$(( ++idx ))" "$line"
		done
	)
	echo
	echo "You should reboot as soon as possible."
	echo "The full report(s) can be found in the kernel log (dmesg)."
	echo "Consider reporting them via your distribution's bug tracking tools."
	exit 42
}

check_deps
try_enable_or_die
summarize_reports