| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-or-later |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * Linux Kernel Dump Test Module for testing kernel crashes conditions: |
|---|
| 3 | 4 | * induces system failures at predefined crashpoints and under predefined |
|---|
| 4 | 5 | * operational conditions in order to evaluate the reliability of kernel |
|---|
| 5 | 6 | * sanity checking and crash dumps obtained using different dumping |
|---|
| 6 | 7 | * solutions. |
|---|
| 7 | | - * |
|---|
| 8 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 9 | | - * it under the terms of the GNU General Public License as published by |
|---|
| 10 | | - * the Free Software Foundation; either version 2 of the License, or |
|---|
| 11 | | - * (at your option) any later version. |
|---|
| 12 | | - * |
|---|
| 13 | | - * This program is distributed in the hope that it will be useful, |
|---|
| 14 | | - * but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 15 | | - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 16 | | - * GNU General Public License for more details. |
|---|
| 17 | | - * |
|---|
| 18 | | - * You should have received a copy of the GNU General Public License |
|---|
| 19 | | - * along with this program; if not, write to the Free Software |
|---|
| 20 | | - * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
|---|
| 21 | 8 | * |
|---|
| 22 | 9 | * Copyright (C) IBM Corporation, 2006 |
|---|
| 23 | 10 | * |
|---|
| .. | .. |
|---|
| 28 | 15 | * |
|---|
| 29 | 16 | * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net> |
|---|
| 30 | 17 | * |
|---|
| 31 | | - * See Documentation/fault-injection/provoke-crashes.txt for instructions |
|---|
| 18 | + * See Documentation/fault-injection/provoke-crashes.rst for instructions |
|---|
| 32 | 19 | */ |
|---|
| 33 | 20 | #include "lkdtm.h" |
|---|
| 34 | 21 | #include <linux/fs.h> |
|---|
| .. | .. |
|---|
| 37 | 24 | #include <linux/kprobes.h> |
|---|
| 38 | 25 | #include <linux/list.h> |
|---|
| 39 | 26 | #include <linux/init.h> |
|---|
| 40 | | -#include <linux/interrupt.h> |
|---|
| 41 | | -#include <linux/hrtimer.h> |
|---|
| 42 | 27 | #include <linux/slab.h> |
|---|
| 43 | | -#include <scsi/scsi_cmnd.h> |
|---|
| 44 | 28 | #include <linux/debugfs.h> |
|---|
| 45 | | - |
|---|
| 46 | | -#ifdef CONFIG_IDE |
|---|
| 47 | | -#include <linux/ide.h> |
|---|
| 48 | | -#endif |
|---|
| 49 | 29 | |
|---|
| 50 | 30 | #define DEFAULT_COUNT 10 |
|---|
| 51 | 31 | |
|---|
| .. | .. |
|---|
| 101 | 81 | CRASHPOINT("FS_DEVRW", "ll_rw_block"), |
|---|
| 102 | 82 | CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"), |
|---|
| 103 | 83 | CRASHPOINT("TIMERADD", "hrtimer_start"), |
|---|
| 104 | | - CRASHPOINT("SCSI_DISPATCH_CMD", "scsi_dispatch_cmd"), |
|---|
| 105 | | -# ifdef CONFIG_IDE |
|---|
| 84 | + CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"), |
|---|
| 106 | 85 | CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"), |
|---|
| 107 | | -# endif |
|---|
| 108 | 86 | #endif |
|---|
| 109 | 87 | }; |
|---|
| 110 | 88 | |
|---|
| .. | .. |
|---|
| 126 | 104 | CRASHTYPE(PANIC), |
|---|
| 127 | 105 | CRASHTYPE(BUG), |
|---|
| 128 | 106 | CRASHTYPE(WARNING), |
|---|
| 107 | + CRASHTYPE(WARNING_MESSAGE), |
|---|
| 129 | 108 | CRASHTYPE(EXCEPTION), |
|---|
| 130 | 109 | CRASHTYPE(LOOP), |
|---|
| 131 | | - CRASHTYPE(OVERFLOW), |
|---|
| 132 | | - CRASHTYPE(CORRUPT_LIST_ADD), |
|---|
| 133 | | - CRASHTYPE(CORRUPT_LIST_DEL), |
|---|
| 134 | | - CRASHTYPE(CORRUPT_USER_DS), |
|---|
| 110 | + CRASHTYPE(EXHAUST_STACK), |
|---|
| 135 | 111 | CRASHTYPE(CORRUPT_STACK), |
|---|
| 136 | 112 | CRASHTYPE(CORRUPT_STACK_STRONG), |
|---|
| 113 | + CRASHTYPE(CORRUPT_LIST_ADD), |
|---|
| 114 | + CRASHTYPE(CORRUPT_LIST_DEL), |
|---|
| 137 | 115 | CRASHTYPE(STACK_GUARD_PAGE_LEADING), |
|---|
| 138 | 116 | CRASHTYPE(STACK_GUARD_PAGE_TRAILING), |
|---|
| 117 | + CRASHTYPE(UNSET_SMEP), |
|---|
| 118 | + CRASHTYPE(CORRUPT_PAC), |
|---|
| 139 | 119 | CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE), |
|---|
| 140 | 120 | CRASHTYPE(OVERWRITE_ALLOCATION), |
|---|
| 141 | 121 | CRASHTYPE(WRITE_AFTER_FREE), |
|---|
| 142 | 122 | CRASHTYPE(READ_AFTER_FREE), |
|---|
| 143 | 123 | CRASHTYPE(WRITE_BUDDY_AFTER_FREE), |
|---|
| 144 | 124 | CRASHTYPE(READ_BUDDY_AFTER_FREE), |
|---|
| 125 | + CRASHTYPE(SLAB_FREE_DOUBLE), |
|---|
| 126 | + CRASHTYPE(SLAB_FREE_CROSS), |
|---|
| 127 | + CRASHTYPE(SLAB_FREE_PAGE), |
|---|
| 145 | 128 | CRASHTYPE(SOFTLOCKUP), |
|---|
| 146 | 129 | CRASHTYPE(HARDLOCKUP), |
|---|
| 147 | 130 | CRASHTYPE(SPINLOCKUP), |
|---|
| 148 | 131 | CRASHTYPE(HUNG_TASK), |
|---|
| 132 | + CRASHTYPE(OVERFLOW_SIGNED), |
|---|
| 133 | + CRASHTYPE(OVERFLOW_UNSIGNED), |
|---|
| 134 | + CRASHTYPE(ARRAY_BOUNDS), |
|---|
| 149 | 135 | CRASHTYPE(EXEC_DATA), |
|---|
| 150 | 136 | CRASHTYPE(EXEC_STACK), |
|---|
| 151 | 137 | CRASHTYPE(EXEC_KMALLOC), |
|---|
| .. | .. |
|---|
| 185 | 171 | CRASHTYPE(USERCOPY_STACK_FRAME_FROM), |
|---|
| 186 | 172 | CRASHTYPE(USERCOPY_STACK_BEYOND), |
|---|
| 187 | 173 | CRASHTYPE(USERCOPY_KERNEL), |
|---|
| 174 | + CRASHTYPE(STACKLEAK_ERASING), |
|---|
| 175 | + CRASHTYPE(CFI_FORWARD_PROTO), |
|---|
| 176 | + CRASHTYPE(DOUBLE_FAULT), |
|---|
| 188 | 177 | }; |
|---|
| 189 | 178 | |
|---|
| 190 | 179 | |
|---|
| .. | .. |
|---|
| 347 | 336 | if (buf == NULL) |
|---|
| 348 | 337 | return -ENOMEM; |
|---|
| 349 | 338 | |
|---|
| 350 | | - n = snprintf(buf, PAGE_SIZE, "Available crash types:\n"); |
|---|
| 339 | + n = scnprintf(buf, PAGE_SIZE, "Available crash types:\n"); |
|---|
| 351 | 340 | for (i = 0; i < ARRAY_SIZE(crashtypes); i++) { |
|---|
| 352 | | - n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", |
|---|
| 341 | + n += scnprintf(buf + n, PAGE_SIZE - n, "%s\n", |
|---|
| 353 | 342 | crashtypes[i].name); |
|---|
| 354 | 343 | } |
|---|
| 355 | 344 | buf[n] = '\0'; |
|---|
| .. | .. |
|---|
| 407 | 396 | { |
|---|
| 408 | 397 | struct crashpoint *crashpoint = NULL; |
|---|
| 409 | 398 | const struct crashtype *crashtype = NULL; |
|---|
| 410 | | - int ret = -EINVAL; |
|---|
| 399 | + int ret; |
|---|
| 411 | 400 | int i; |
|---|
| 412 | 401 | |
|---|
| 413 | 402 | /* Neither or both of these need to be set */ |
|---|
| .. | .. |
|---|
| 446 | 435 | lkdtm_bugs_init(&recur_count); |
|---|
| 447 | 436 | lkdtm_perms_init(); |
|---|
| 448 | 437 | lkdtm_usercopy_init(); |
|---|
| 438 | + lkdtm_heap_init(); |
|---|
| 449 | 439 | |
|---|
| 450 | 440 | /* Register debugfs interface */ |
|---|
| 451 | 441 | lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL); |
|---|
| 452 | | - if (!lkdtm_debugfs_root) { |
|---|
| 453 | | - pr_err("creating root dir failed\n"); |
|---|
| 454 | | - return -ENODEV; |
|---|
| 455 | | - } |
|---|
| 456 | 442 | |
|---|
| 457 | 443 | /* Install debugfs trigger files. */ |
|---|
| 458 | 444 | for (i = 0; i < ARRAY_SIZE(crashpoints); i++) { |
|---|
| 459 | 445 | struct crashpoint *cur = &crashpoints[i]; |
|---|
| 460 | | - struct dentry *de; |
|---|
| 461 | 446 | |
|---|
| 462 | | - de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root, |
|---|
| 463 | | - cur, &cur->fops); |
|---|
| 464 | | - if (de == NULL) { |
|---|
| 465 | | - pr_err("could not create crashpoint %s\n", cur->name); |
|---|
| 466 | | - goto out_err; |
|---|
| 467 | | - } |
|---|
| 447 | + debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root, cur, |
|---|
| 448 | + &cur->fops); |
|---|
| 468 | 449 | } |
|---|
| 469 | 450 | |
|---|
| 470 | 451 | /* Install crashpoint if one was selected. */ |
|---|
| .. | .. |
|---|
| 492 | 473 | debugfs_remove_recursive(lkdtm_debugfs_root); |
|---|
| 493 | 474 | |
|---|
| 494 | 475 | /* Handle test-specific clean-up. */ |
|---|
| 476 | + lkdtm_heap_exit(); |
|---|
| 495 | 477 | lkdtm_usercopy_exit(); |
|---|
| 496 | 478 | |
|---|
| 497 | 479 | if (lkdtm_kprobe != NULL) |
|---|