.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
---|
1 | 2 | /* |
---|
2 | 3 | * Linux Kernel Dump Test Module for testing kernel crashes conditions: |
---|
3 | 4 | * induces system failures at predefined crashpoints and under predefined |
---|
4 | 5 | * operational conditions in order to evaluate the reliability of kernel |
---|
5 | 6 | * sanity checking and crash dumps obtained using different dumping |
---|
6 | 7 | * solutions. |
---|
7 | | - * |
---|
8 | | - * This program is free software; you can redistribute it and/or modify |
---|
9 | | - * it under the terms of the GNU General Public License as published by |
---|
10 | | - * the Free Software Foundation; either version 2 of the License, or |
---|
11 | | - * (at your option) any later version. |
---|
12 | | - * |
---|
13 | | - * This program is distributed in the hope that it will be useful, |
---|
14 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
15 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
16 | | - * GNU General Public License for more details. |
---|
17 | | - * |
---|
18 | | - * You should have received a copy of the GNU General Public License |
---|
19 | | - * along with this program; if not, write to the Free Software |
---|
20 | | - * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
---|
21 | 8 | * |
---|
22 | 9 | * Copyright (C) IBM Corporation, 2006 |
---|
23 | 10 | * |
---|
.. | .. |
---|
28 | 15 | * |
---|
29 | 16 | * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net> |
---|
30 | 17 | * |
---|
31 | | - * See Documentation/fault-injection/provoke-crashes.txt for instructions |
---|
| 18 | + * See Documentation/fault-injection/provoke-crashes.rst for instructions |
---|
32 | 19 | */ |
---|
33 | 20 | #include "lkdtm.h" |
---|
34 | 21 | #include <linux/fs.h> |
---|
.. | .. |
---|
37 | 24 | #include <linux/kprobes.h> |
---|
38 | 25 | #include <linux/list.h> |
---|
39 | 26 | #include <linux/init.h> |
---|
40 | | -#include <linux/interrupt.h> |
---|
41 | | -#include <linux/hrtimer.h> |
---|
42 | 27 | #include <linux/slab.h> |
---|
43 | | -#include <scsi/scsi_cmnd.h> |
---|
44 | 28 | #include <linux/debugfs.h> |
---|
45 | | - |
---|
46 | | -#ifdef CONFIG_IDE |
---|
47 | | -#include <linux/ide.h> |
---|
48 | | -#endif |
---|
49 | 29 | |
---|
50 | 30 | #define DEFAULT_COUNT 10 |
---|
51 | 31 | |
---|
.. | .. |
---|
101 | 81 | CRASHPOINT("FS_DEVRW", "ll_rw_block"), |
---|
102 | 82 | CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"), |
---|
103 | 83 | CRASHPOINT("TIMERADD", "hrtimer_start"), |
---|
104 | | - CRASHPOINT("SCSI_DISPATCH_CMD", "scsi_dispatch_cmd"), |
---|
105 | | -# ifdef CONFIG_IDE |
---|
| 84 | + CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"), |
---|
106 | 85 | CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"), |
---|
107 | | -# endif |
---|
108 | 86 | #endif |
---|
109 | 87 | }; |
---|
110 | 88 | |
---|
.. | .. |
---|
126 | 104 | CRASHTYPE(PANIC), |
---|
127 | 105 | CRASHTYPE(BUG), |
---|
128 | 106 | CRASHTYPE(WARNING), |
---|
| 107 | + CRASHTYPE(WARNING_MESSAGE), |
---|
129 | 108 | CRASHTYPE(EXCEPTION), |
---|
130 | 109 | CRASHTYPE(LOOP), |
---|
131 | | - CRASHTYPE(OVERFLOW), |
---|
132 | | - CRASHTYPE(CORRUPT_LIST_ADD), |
---|
133 | | - CRASHTYPE(CORRUPT_LIST_DEL), |
---|
134 | | - CRASHTYPE(CORRUPT_USER_DS), |
---|
| 110 | + CRASHTYPE(EXHAUST_STACK), |
---|
135 | 111 | CRASHTYPE(CORRUPT_STACK), |
---|
136 | 112 | CRASHTYPE(CORRUPT_STACK_STRONG), |
---|
| 113 | + CRASHTYPE(CORRUPT_LIST_ADD), |
---|
| 114 | + CRASHTYPE(CORRUPT_LIST_DEL), |
---|
137 | 115 | CRASHTYPE(STACK_GUARD_PAGE_LEADING), |
---|
138 | 116 | CRASHTYPE(STACK_GUARD_PAGE_TRAILING), |
---|
| 117 | + CRASHTYPE(UNSET_SMEP), |
---|
| 118 | + CRASHTYPE(CORRUPT_PAC), |
---|
139 | 119 | CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE), |
---|
140 | 120 | CRASHTYPE(OVERWRITE_ALLOCATION), |
---|
141 | 121 | CRASHTYPE(WRITE_AFTER_FREE), |
---|
142 | 122 | CRASHTYPE(READ_AFTER_FREE), |
---|
143 | 123 | CRASHTYPE(WRITE_BUDDY_AFTER_FREE), |
---|
144 | 124 | CRASHTYPE(READ_BUDDY_AFTER_FREE), |
---|
| 125 | + CRASHTYPE(SLAB_FREE_DOUBLE), |
---|
| 126 | + CRASHTYPE(SLAB_FREE_CROSS), |
---|
| 127 | + CRASHTYPE(SLAB_FREE_PAGE), |
---|
145 | 128 | CRASHTYPE(SOFTLOCKUP), |
---|
146 | 129 | CRASHTYPE(HARDLOCKUP), |
---|
147 | 130 | CRASHTYPE(SPINLOCKUP), |
---|
148 | 131 | CRASHTYPE(HUNG_TASK), |
---|
| 132 | + CRASHTYPE(OVERFLOW_SIGNED), |
---|
| 133 | + CRASHTYPE(OVERFLOW_UNSIGNED), |
---|
| 134 | + CRASHTYPE(ARRAY_BOUNDS), |
---|
149 | 135 | CRASHTYPE(EXEC_DATA), |
---|
150 | 136 | CRASHTYPE(EXEC_STACK), |
---|
151 | 137 | CRASHTYPE(EXEC_KMALLOC), |
---|
.. | .. |
---|
185 | 171 | CRASHTYPE(USERCOPY_STACK_FRAME_FROM), |
---|
186 | 172 | CRASHTYPE(USERCOPY_STACK_BEYOND), |
---|
187 | 173 | CRASHTYPE(USERCOPY_KERNEL), |
---|
| 174 | + CRASHTYPE(STACKLEAK_ERASING), |
---|
| 175 | + CRASHTYPE(CFI_FORWARD_PROTO), |
---|
| 176 | + CRASHTYPE(DOUBLE_FAULT), |
---|
188 | 177 | }; |
---|
189 | 178 | |
---|
190 | 179 | |
---|
.. | .. |
---|
347 | 336 | if (buf == NULL) |
---|
348 | 337 | return -ENOMEM; |
---|
349 | 338 | |
---|
350 | | - n = snprintf(buf, PAGE_SIZE, "Available crash types:\n"); |
---|
| 339 | + n = scnprintf(buf, PAGE_SIZE, "Available crash types:\n"); |
---|
351 | 340 | for (i = 0; i < ARRAY_SIZE(crashtypes); i++) { |
---|
352 | | - n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", |
---|
| 341 | + n += scnprintf(buf + n, PAGE_SIZE - n, "%s\n", |
---|
353 | 342 | crashtypes[i].name); |
---|
354 | 343 | } |
---|
355 | 344 | buf[n] = '\0'; |
---|
.. | .. |
---|
407 | 396 | { |
---|
408 | 397 | struct crashpoint *crashpoint = NULL; |
---|
409 | 398 | const struct crashtype *crashtype = NULL; |
---|
410 | | - int ret = -EINVAL; |
---|
| 399 | + int ret; |
---|
411 | 400 | int i; |
---|
412 | 401 | |
---|
413 | 402 | /* Neither or both of these need to be set */ |
---|
.. | .. |
---|
446 | 435 | lkdtm_bugs_init(&recur_count); |
---|
447 | 436 | lkdtm_perms_init(); |
---|
448 | 437 | lkdtm_usercopy_init(); |
---|
| 438 | + lkdtm_heap_init(); |
---|
449 | 439 | |
---|
450 | 440 | /* Register debugfs interface */ |
---|
451 | 441 | lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL); |
---|
452 | | - if (!lkdtm_debugfs_root) { |
---|
453 | | - pr_err("creating root dir failed\n"); |
---|
454 | | - return -ENODEV; |
---|
455 | | - } |
---|
456 | 442 | |
---|
457 | 443 | /* Install debugfs trigger files. */ |
---|
458 | 444 | for (i = 0; i < ARRAY_SIZE(crashpoints); i++) { |
---|
459 | 445 | struct crashpoint *cur = &crashpoints[i]; |
---|
460 | | - struct dentry *de; |
---|
461 | 446 | |
---|
462 | | - de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root, |
---|
463 | | - cur, &cur->fops); |
---|
464 | | - if (de == NULL) { |
---|
465 | | - pr_err("could not create crashpoint %s\n", cur->name); |
---|
466 | | - goto out_err; |
---|
467 | | - } |
---|
| 447 | + debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root, cur, |
---|
| 448 | + &cur->fops); |
---|
468 | 449 | } |
---|
469 | 450 | |
---|
470 | 451 | /* Install crashpoint if one was selected. */ |
---|
.. | .. |
---|
492 | 473 | debugfs_remove_recursive(lkdtm_debugfs_root); |
---|
493 | 474 | |
---|
494 | 475 | /* Handle test-specific clean-up. */ |
---|
| 476 | + lkdtm_heap_exit(); |
---|
495 | 477 | lkdtm_usercopy_exit(); |
---|
496 | 478 | |
---|
497 | 479 | if (lkdtm_kprobe != NULL) |
---|