1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34#include <linux/kernel.h>
35#include <linux/fs.h>
36#include <linux/module.h>
37#include <linux/buffer_head.h>
38#include <linux/kprobes.h>
39#include <linux/list.h>
40#include <linux/init.h>
41#include <linux/interrupt.h>
42#include <linux/hrtimer.h>
43#include <linux/slab.h>
44#include <scsi/scsi_cmnd.h>
45#include <linux/debugfs.h>
46#include <linux/vmalloc.h>
47
48#ifdef CONFIG_IDE
49#include <linux/ide.h>
50#endif
51
52#define DEFAULT_COUNT 10
53#define REC_NUM_DEFAULT 10
54#define EXEC_SIZE 64
55
56enum cname {
57 CN_INVALID,
58 CN_INT_HARDWARE_ENTRY,
59 CN_INT_HW_IRQ_EN,
60 CN_INT_TASKLET_ENTRY,
61 CN_FS_DEVRW,
62 CN_MEM_SWAPOUT,
63 CN_TIMERADD,
64 CN_SCSI_DISPATCH_CMD,
65 CN_IDE_CORE_CP,
66 CN_DIRECT,
67};
68
69enum ctype {
70 CT_NONE,
71 CT_PANIC,
72 CT_BUG,
73 CT_WARNING,
74 CT_EXCEPTION,
75 CT_LOOP,
76 CT_OVERFLOW,
77 CT_CORRUPT_STACK,
78 CT_UNALIGNED_LOAD_STORE_WRITE,
79 CT_OVERWRITE_ALLOCATION,
80 CT_WRITE_AFTER_FREE,
81 CT_SOFTLOCKUP,
82 CT_HARDLOCKUP,
83 CT_SPINLOCKUP,
84 CT_HUNG_TASK,
85 CT_EXEC_DATA,
86 CT_EXEC_STACK,
87 CT_EXEC_KMALLOC,
88 CT_EXEC_VMALLOC,
89};
90
91static char* cp_name[] = {
92 "INT_HARDWARE_ENTRY",
93 "INT_HW_IRQ_EN",
94 "INT_TASKLET_ENTRY",
95 "FS_DEVRW",
96 "MEM_SWAPOUT",
97 "TIMERADD",
98 "SCSI_DISPATCH_CMD",
99 "IDE_CORE_CP",
100 "DIRECT",
101};
102
103static char* cp_type[] = {
104 "PANIC",
105 "BUG",
106 "WARNING",
107 "EXCEPTION",
108 "LOOP",
109 "OVERFLOW",
110 "CORRUPT_STACK",
111 "UNALIGNED_LOAD_STORE_WRITE",
112 "OVERWRITE_ALLOCATION",
113 "WRITE_AFTER_FREE",
114 "SOFTLOCKUP",
115 "HARDLOCKUP",
116 "SPINLOCKUP",
117 "HUNG_TASK",
118 "EXEC_DATA",
119 "EXEC_STACK",
120 "EXEC_KMALLOC",
121 "EXEC_VMALLOC",
122};
123
124static struct jprobe lkdtm;
125
126static int lkdtm_parse_commandline(void);
127static void lkdtm_handler(void);
128
129static char* cpoint_name;
130static char* cpoint_type;
131static int cpoint_count = DEFAULT_COUNT;
132static int recur_count = REC_NUM_DEFAULT;
133
134static enum cname cpoint = CN_INVALID;
135static enum ctype cptype = CT_NONE;
136static int count = DEFAULT_COUNT;
137static DEFINE_SPINLOCK(count_lock);
138static DEFINE_SPINLOCK(lock_me_up);
139
140static u8 data_area[EXEC_SIZE];
141
142module_param(recur_count, int, 0644);
143MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
144 "default is 10");
145module_param(cpoint_name, charp, 0444);
146MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
147module_param(cpoint_type, charp, 0444);
148MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
149 "hitting the crash point");
150module_param(cpoint_count, int, 0644);
151MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
152 "crash point is to be hit to trigger action");
153
154static unsigned int jp_do_irq(unsigned int irq)
155{
156 lkdtm_handler();
157 jprobe_return();
158 return 0;
159}
160
161static irqreturn_t jp_handle_irq_event(unsigned int irq,
162 struct irqaction *action)
163{
164 lkdtm_handler();
165 jprobe_return();
166 return 0;
167}
168
169static void jp_tasklet_action(struct softirq_action *a)
170{
171 lkdtm_handler();
172 jprobe_return();
173}
174
175static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
176{
177 lkdtm_handler();
178 jprobe_return();
179}
180
181struct scan_control;
182
183static unsigned long jp_shrink_inactive_list(unsigned long max_scan,
184 struct zone *zone,
185 struct scan_control *sc)
186{
187 lkdtm_handler();
188 jprobe_return();
189 return 0;
190}
191
192static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim,
193 const enum hrtimer_mode mode)
194{
195 lkdtm_handler();
196 jprobe_return();
197 return 0;
198}
199
200static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
201{
202 lkdtm_handler();
203 jprobe_return();
204 return 0;
205}
206
207#ifdef CONFIG_IDE
208int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
209 struct block_device *bdev, unsigned int cmd,
210 unsigned long arg)
211{
212 lkdtm_handler();
213 jprobe_return();
214 return 0;
215}
216#endif
217
218
219static enum ctype parse_cp_type(const char *what, size_t count)
220{
221 int i;
222
223 for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
224 if (!strcmp(what, cp_type[i]))
225 return i + 1;
226 }
227
228 return CT_NONE;
229}
230
231static const char *cp_type_to_str(enum ctype type)
232{
233 if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type))
234 return "None";
235
236 return cp_type[type - 1];
237}
238
239static const char *cp_name_to_str(enum cname name)
240{
241 if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
242 return "INVALID";
243
244 return cp_name[name - 1];
245}
246
247
248static int lkdtm_parse_commandline(void)
249{
250 int i;
251 unsigned long flags;
252
253 if (cpoint_count < 1 || recur_count < 1)
254 return -EINVAL;
255
256 spin_lock_irqsave(&count_lock, flags);
257 count = cpoint_count;
258 spin_unlock_irqrestore(&count_lock, flags);
259
260
261 if (!cpoint_type && !cpoint_name)
262 return 0;
263
264
265 if (!cpoint_type || !cpoint_name)
266 return -EINVAL;
267
268 cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
269 if (cptype == CT_NONE)
270 return -EINVAL;
271
272 for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
273 if (!strcmp(cpoint_name, cp_name[i])) {
274 cpoint = i + 1;
275 return 0;
276 }
277 }
278
279
280 return -EINVAL;
281}
282
283static int recursive_loop(int a)
284{
285 char buf[1024];
286
287 memset(buf,0xFF,1024);
288 recur_count--;
289 if (!recur_count)
290 return 0;
291 else
292 return recursive_loop(a);
293}
294
295static void do_nothing(void)
296{
297 return;
298}
299
300static void execute_location(void *dst)
301{
302 void (*func)(void) = dst;
303
304 memcpy(dst, do_nothing, EXEC_SIZE);
305 func();
306}
307
308static void lkdtm_do_action(enum ctype which)
309{
310 switch (which) {
311 case CT_PANIC:
312 panic("dumptest");
313 break;
314 case CT_BUG:
315 BUG();
316 break;
317 case CT_WARNING:
318 WARN_ON(1);
319 break;
320 case CT_EXCEPTION:
321 *((int *) 0) = 0;
322 break;
323 case CT_LOOP:
324 for (;;)
325 ;
326 break;
327 case CT_OVERFLOW:
328 (void) recursive_loop(0);
329 break;
330 case CT_CORRUPT_STACK: {
331
332 volatile char data[8];
333
334 memset((void *)data, 0, 64);
335 break;
336 }
337 case CT_UNALIGNED_LOAD_STORE_WRITE: {
338 static u8 data[5] __attribute__((aligned(4))) = {1, 2,
339 3, 4, 5};
340 u32 *p;
341 u32 val = 0x12345678;
342
343 p = (u32 *)(data + 1);
344 if (*p == 0)
345 val = 0x87654321;
346 *p = val;
347 break;
348 }
349 case CT_OVERWRITE_ALLOCATION: {
350 size_t len = 1020;
351 u32 *data = kmalloc(len, GFP_KERNEL);
352
353 data[1024 / sizeof(u32)] = 0x12345678;
354 kfree(data);
355 break;
356 }
357 case CT_WRITE_AFTER_FREE: {
358 size_t len = 1024;
359 u32 *data = kmalloc(len, GFP_KERNEL);
360
361 kfree(data);
362 schedule();
363 memset(data, 0x78, len);
364 break;
365 }
366 case CT_SOFTLOCKUP:
367 preempt_disable();
368 for (;;)
369 cpu_relax();
370 break;
371 case CT_HARDLOCKUP:
372 local_irq_disable();
373 for (;;)
374 cpu_relax();
375 break;
376 case CT_SPINLOCKUP:
377
378 spin_lock(&lock_me_up);
379 break;
380 case CT_HUNG_TASK:
381 set_current_state(TASK_UNINTERRUPTIBLE);
382 schedule();
383 break;
384 case CT_EXEC_DATA:
385 execute_location(data_area);
386 break;
387 case CT_EXEC_STACK: {
388 u8 stack_area[EXEC_SIZE];
389 execute_location(stack_area);
390 break;
391 }
392 case CT_EXEC_KMALLOC: {
393 u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL);
394 execute_location(kmalloc_area);
395 kfree(kmalloc_area);
396 break;
397 }
398 case CT_EXEC_VMALLOC: {
399 u32 *vmalloc_area = vmalloc(EXEC_SIZE);
400 execute_location(vmalloc_area);
401 vfree(vmalloc_area);
402 break;
403 }
404 case CT_NONE:
405 default:
406 break;
407 }
408
409}
410
411static void lkdtm_handler(void)
412{
413 unsigned long flags;
414 bool do_it = false;
415
416 spin_lock_irqsave(&count_lock, flags);
417 count--;
418 printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
419 cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
420
421 if (count == 0) {
422 do_it = true;
423 count = cpoint_count;
424 }
425 spin_unlock_irqrestore(&count_lock, flags);
426
427 if (do_it)
428 lkdtm_do_action(cptype);
429}
430
431static int lkdtm_register_cpoint(enum cname which)
432{
433 int ret;
434
435 cpoint = CN_INVALID;
436 if (lkdtm.entry != NULL)
437 unregister_jprobe(&lkdtm);
438
439 switch (which) {
440 case CN_DIRECT:
441 lkdtm_do_action(cptype);
442 return 0;
443 case CN_INT_HARDWARE_ENTRY:
444 lkdtm.kp.symbol_name = "do_IRQ";
445 lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
446 break;
447 case CN_INT_HW_IRQ_EN:
448 lkdtm.kp.symbol_name = "handle_IRQ_event";
449 lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event;
450 break;
451 case CN_INT_TASKLET_ENTRY:
452 lkdtm.kp.symbol_name = "tasklet_action";
453 lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action;
454 break;
455 case CN_FS_DEVRW:
456 lkdtm.kp.symbol_name = "ll_rw_block";
457 lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
458 break;
459 case CN_MEM_SWAPOUT:
460 lkdtm.kp.symbol_name = "shrink_inactive_list";
461 lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
462 break;
463 case CN_TIMERADD:
464 lkdtm.kp.symbol_name = "hrtimer_start";
465 lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start;
466 break;
467 case CN_SCSI_DISPATCH_CMD:
468 lkdtm.kp.symbol_name = "scsi_dispatch_cmd";
469 lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd;
470 break;
471 case CN_IDE_CORE_CP:
472#ifdef CONFIG_IDE
473 lkdtm.kp.symbol_name = "generic_ide_ioctl";
474 lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
475#else
476 printk(KERN_INFO "lkdtm: Crash point not available\n");
477 return -EINVAL;
478#endif
479 break;
480 default:
481 printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
482 return -EINVAL;
483 }
484
485 cpoint = which;
486 if ((ret = register_jprobe(&lkdtm)) < 0) {
487 printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
488 cpoint = CN_INVALID;
489 }
490
491 return ret;
492}
493
494static ssize_t do_register_entry(enum cname which, struct file *f,
495 const char __user *user_buf, size_t count, loff_t *off)
496{
497 char *buf;
498 int err;
499
500 if (count >= PAGE_SIZE)
501 return -EINVAL;
502
503 buf = (char *)__get_free_page(GFP_KERNEL);
504 if (!buf)
505 return -ENOMEM;
506 if (copy_from_user(buf, user_buf, count)) {
507 free_page((unsigned long) buf);
508 return -EFAULT;
509 }
510
511 buf[count] = '\0';
512 strim(buf);
513
514 cptype = parse_cp_type(buf, count);
515 free_page((unsigned long) buf);
516
517 if (cptype == CT_NONE)
518 return -EINVAL;
519
520 err = lkdtm_register_cpoint(which);
521 if (err < 0)
522 return err;
523
524 *off += count;
525
526 return count;
527}
528
529
530static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
531 size_t count, loff_t *off)
532{
533 char *buf;
534 int i, n, out;
535
536 buf = (char *)__get_free_page(GFP_KERNEL);
537 if (buf == NULL)
538 return -ENOMEM;
539
540 n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
541 for (i = 0; i < ARRAY_SIZE(cp_type); i++)
542 n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
543 buf[n] = '\0';
544
545 out = simple_read_from_buffer(user_buf, count, off,
546 buf, n);
547 free_page((unsigned long) buf);
548
549 return out;
550}
551
552static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
553{
554 return 0;
555}
556
557
558static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
559 size_t count, loff_t *off)
560{
561 return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off);
562}
563
564static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
565 size_t count, loff_t *off)
566{
567 return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off);
568}
569
570static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
571 size_t count, loff_t *off)
572{
573 return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off);
574}
575
576static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
577 size_t count, loff_t *off)
578{
579 return do_register_entry(CN_FS_DEVRW, f, buf, count, off);
580}
581
582static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
583 size_t count, loff_t *off)
584{
585 return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off);
586}
587
588static ssize_t timeradd_entry(struct file *f, const char __user *buf,
589 size_t count, loff_t *off)
590{
591 return do_register_entry(CN_TIMERADD, f, buf, count, off);
592}
593
594static ssize_t scsi_dispatch_cmd_entry(struct file *f,
595 const char __user *buf, size_t count, loff_t *off)
596{
597 return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off);
598}
599
600static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
601 size_t count, loff_t *off)
602{
603 return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off);
604}
605
606
607static ssize_t direct_entry(struct file *f, const char __user *user_buf,
608 size_t count, loff_t *off)
609{
610 enum ctype type;
611 char *buf;
612
613 if (count >= PAGE_SIZE)
614 return -EINVAL;
615 if (count < 1)
616 return -EINVAL;
617
618 buf = (char *)__get_free_page(GFP_KERNEL);
619 if (!buf)
620 return -ENOMEM;
621 if (copy_from_user(buf, user_buf, count)) {
622 free_page((unsigned long) buf);
623 return -EFAULT;
624 }
625
626 buf[count] = '\0';
627 strim(buf);
628
629 type = parse_cp_type(buf, count);
630 free_page((unsigned long) buf);
631 if (type == CT_NONE)
632 return -EINVAL;
633
634 printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
635 cp_type_to_str(type));
636 lkdtm_do_action(type);
637 *off += count;
638
639 return count;
640}
641
642struct crash_entry {
643 const char *name;
644 const struct file_operations fops;
645};
646
647static const struct crash_entry crash_entries[] = {
648 {"DIRECT", {.read = lkdtm_debugfs_read,
649 .llseek = generic_file_llseek,
650 .open = lkdtm_debugfs_open,
651 .write = direct_entry} },
652 {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
653 .llseek = generic_file_llseek,
654 .open = lkdtm_debugfs_open,
655 .write = int_hardware_entry} },
656 {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
657 .llseek = generic_file_llseek,
658 .open = lkdtm_debugfs_open,
659 .write = int_hw_irq_en} },
660 {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
661 .llseek = generic_file_llseek,
662 .open = lkdtm_debugfs_open,
663 .write = int_tasklet_entry} },
664 {"FS_DEVRW", {.read = lkdtm_debugfs_read,
665 .llseek = generic_file_llseek,
666 .open = lkdtm_debugfs_open,
667 .write = fs_devrw_entry} },
668 {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
669 .llseek = generic_file_llseek,
670 .open = lkdtm_debugfs_open,
671 .write = mem_swapout_entry} },
672 {"TIMERADD", {.read = lkdtm_debugfs_read,
673 .llseek = generic_file_llseek,
674 .open = lkdtm_debugfs_open,
675 .write = timeradd_entry} },
676 {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
677 .llseek = generic_file_llseek,
678 .open = lkdtm_debugfs_open,
679 .write = scsi_dispatch_cmd_entry} },
680 {"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
681 .llseek = generic_file_llseek,
682 .open = lkdtm_debugfs_open,
683 .write = ide_core_cp_entry} },
684};
685
686static struct dentry *lkdtm_debugfs_root;
687
688static int __init lkdtm_module_init(void)
689{
690 int ret = -EINVAL;
691 int n_debugfs_entries = 1;
692 int i;
693
694
695 lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
696 if (!lkdtm_debugfs_root) {
697 printk(KERN_ERR "lkdtm: creating root dir failed\n");
698 return -ENODEV;
699 }
700
701#ifdef CONFIG_KPROBES
702 n_debugfs_entries = ARRAY_SIZE(crash_entries);
703#endif
704
705 for (i = 0; i < n_debugfs_entries; i++) {
706 const struct crash_entry *cur = &crash_entries[i];
707 struct dentry *de;
708
709 de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
710 NULL, &cur->fops);
711 if (de == NULL) {
712 printk(KERN_ERR "lkdtm: could not create %s\n",
713 cur->name);
714 goto out_err;
715 }
716 }
717
718 if (lkdtm_parse_commandline() == -EINVAL) {
719 printk(KERN_INFO "lkdtm: Invalid command\n");
720 goto out_err;
721 }
722
723 if (cpoint != CN_INVALID && cptype != CT_NONE) {
724 ret = lkdtm_register_cpoint(cpoint);
725 if (ret < 0) {
726 printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
727 cpoint);
728 goto out_err;
729 }
730 printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
731 cpoint_name, cpoint_type);
732 } else {
733 printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
734 }
735
736 return 0;
737
738out_err:
739 debugfs_remove_recursive(lkdtm_debugfs_root);
740 return ret;
741}
742
743static void __exit lkdtm_module_exit(void)
744{
745 debugfs_remove_recursive(lkdtm_debugfs_root);
746
747 unregister_jprobe(&lkdtm);
748 printk(KERN_INFO "lkdtm: Crash point unregistered\n");
749}
750
751module_init(lkdtm_module_init);
752module_exit(lkdtm_module_exit);
753
754MODULE_LICENSE("GPL");
755
