1 /* 2 * linux/kernel/panic.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * This function is used through-out the kernel (including mm and fs) 9 * to indicate a major problem. 10 */ 11 #include <linux/debug_locks.h> 12 #include <linux/sched/debug.h> 13 #include <linux/interrupt.h> 14 #include <linux/kmsg_dump.h> 15 #include <linux/kallsyms.h> 16 #include <linux/notifier.h> 17 #include <linux/vt_kern.h> 18 #include <linux/module.h> 19 #include <linux/random.h> 20 #include <linux/ftrace.h> 21 #include <linux/reboot.h> 22 #include <linux/delay.h> 23 #include <linux/kexec.h> 24 #include <linux/sched.h> 25 #include <linux/sysrq.h> 26 #include <linux/init.h> 27 #include <linux/nmi.h> 28 #include <linux/console.h> 29 #include <linux/bug.h> 30 #include <linux/ratelimit.h> 31 #include <linux/debugfs.h> 32 #include <asm/sections.h> 33 34 #define PANIC_TIMER_STEP 100 35 #define PANIC_BLINK_SPD 18 36 37 int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE; 38 static unsigned long tainted_mask = 39 IS_ENABLED(CONFIG_GCC_PLUGIN_RANDSTRUCT) ? (1 << TAINT_RANDSTRUCT) : 0; 40 static int pause_on_oops; 41 static int pause_on_oops_flag; 42 static DEFINE_SPINLOCK(pause_on_oops_lock); 43 bool crash_kexec_post_notifiers; 44 int panic_on_warn __read_mostly; 45 46 int panic_timeout = CONFIG_PANIC_TIMEOUT; 47 EXPORT_SYMBOL_GPL(panic_timeout); 48 49 ATOMIC_NOTIFIER_HEAD(panic_notifier_list); 50 51 EXPORT_SYMBOL(panic_notifier_list); 52 53 static long no_blink(int state) 54 { 55 return 0; 56 } 57 58 /* Returns how long it waited in ms */ 59 long (*panic_blink)(int state); 60 EXPORT_SYMBOL(panic_blink); 61 62 /* 63 * Stop ourself in panic -- architecture code may override this 64 */ 65 void __weak panic_smp_self_stop(void) 66 { 67 while (1) 68 cpu_relax(); 69 } 70 71 /* 72 * Stop ourselves in NMI context if another CPU has already panicked. Arch code 73 * may override this to prepare for crash dumping, e.g. save regs info. 74 */ 75 void __weak nmi_panic_self_stop(struct pt_regs *regs) 76 { 77 panic_smp_self_stop(); 78 } 79 80 /* 81 * Stop other CPUs in panic. Architecture dependent code may override this 82 * with more suitable version. For example, if the architecture supports 83 * crash dump, it should save registers of each stopped CPU and disable 84 * per-CPU features such as virtualization extensions. 85 */ 86 void __weak crash_smp_send_stop(void) 87 { 88 static int cpus_stopped; 89 90 /* 91 * This function can be called twice in panic path, but obviously 92 * we execute this only once. 93 */ 94 if (cpus_stopped) 95 return; 96 97 /* 98 * Note smp_send_stop is the usual smp shutdown function, which 99 * unfortunately means it may not be hardened to work in a panic 100 * situation. 101 */ 102 smp_send_stop(); 103 cpus_stopped = 1; 104 } 105 106 atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID); 107 108 /* 109 * A variant of panic() called from NMI context. We return if we've already 110 * panicked on this CPU. If another CPU already panicked, loop in 111 * nmi_panic_self_stop() which can provide architecture dependent code such 112 * as saving register state for crash dump. 113 */ 114 void nmi_panic(struct pt_regs *regs, const char *msg) 115 { 116 int old_cpu, cpu; 117 118 cpu = raw_smp_processor_id(); 119 old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, cpu); 120 121 if (old_cpu == PANIC_CPU_INVALID) 122 panic("%s", msg); 123 else if (old_cpu != cpu) 124 nmi_panic_self_stop(regs); 125 } 126 EXPORT_SYMBOL(nmi_panic); 127 128 /** 129 * panic - halt the system 130 * @fmt: The text string to print 131 * 132 * Display a message, then perform cleanups. 133 * 134 * This function never returns. 135 */ 136 void panic(const char *fmt, ...) 137 { 138 static char buf[1024]; 139 va_list args; 140 long i, i_next = 0, len; 141 int state = 0; 142 int old_cpu, this_cpu; 143 bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers; 144 145 /* 146 * Disable local interrupts. This will prevent panic_smp_self_stop 147 * from deadlocking the first cpu that invokes the panic, since 148 * there is nothing to prevent an interrupt handler (that runs 149 * after setting panic_cpu) from invoking panic() again. 150 */ 151 local_irq_disable(); 152 153 /* 154 * It's possible to come here directly from a panic-assertion and 155 * not have preempt disabled. Some functions called from here want 156 * preempt to be disabled. No point enabling it later though... 157 * 158 * Only one CPU is allowed to execute the panic code from here. For 159 * multiple parallel invocations of panic, all other CPUs either 160 * stop themself or will wait until they are stopped by the 1st CPU 161 * with smp_send_stop(). 162 * 163 * `old_cpu == PANIC_CPU_INVALID' means this is the 1st CPU which 164 * comes here, so go ahead. 165 * `old_cpu == this_cpu' means we came from nmi_panic() which sets 166 * panic_cpu to this CPU. In this case, this is also the 1st CPU. 167 */ 168 this_cpu = raw_smp_processor_id(); 169 old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, this_cpu); 170 171 if (old_cpu != PANIC_CPU_INVALID && old_cpu != this_cpu) 172 panic_smp_self_stop(); 173 174 console_verbose(); 175 bust_spinlocks(1); 176 va_start(args, fmt); 177 len = vscnprintf(buf, sizeof(buf), fmt, args); 178 va_end(args); 179 180 if (len && buf[len - 1] == '\n') 181 buf[len - 1] = '\0'; 182 183 pr_emerg("Kernel panic - not syncing: %s\n", buf); 184 #ifdef CONFIG_DEBUG_BUGVERBOSE 185 /* 186 * Avoid nested stack-dumping if a panic occurs during oops processing 187 */ 188 if (!test_taint(TAINT_DIE) && oops_in_progress <= 1) 189 dump_stack(); 190 #endif 191 192 /* 193 * If we have crashed and we have a crash kernel loaded let it handle 194 * everything else. 195 * If we want to run this after calling panic_notifiers, pass 196 * the "crash_kexec_post_notifiers" option to the kernel. 197 * 198 * Bypass the panic_cpu check and call __crash_kexec directly. 199 */ 200 if (!_crash_kexec_post_notifiers) { 201 printk_safe_flush_on_panic(); 202 __crash_kexec(NULL); 203 204 /* 205 * Note smp_send_stop is the usual smp shutdown function, which 206 * unfortunately means it may not be hardened to work in a 207 * panic situation. 208 */ 209 smp_send_stop(); 210 } else { 211 /* 212 * If we want to do crash dump after notifier calls and 213 * kmsg_dump, we will need architecture dependent extra 214 * works in addition to stopping other CPUs. 215 */ 216 crash_smp_send_stop(); 217 } 218 219 /* 220 * Run any panic handlers, including those that might need to 221 * add information to the kmsg dump output. 222 */ 223 atomic_notifier_call_chain(&panic_notifier_list, 0, buf); 224 225 /* Call flush even twice. It tries harder with a single online CPU */ 226 printk_safe_flush_on_panic(); 227 kmsg_dump(KMSG_DUMP_PANIC); 228 229 /* 230 * If you doubt kdump always works fine in any situation, 231 * "crash_kexec_post_notifiers" offers you a chance to run 232 * panic_notifiers and dumping kmsg before kdump. 233 * Note: since some panic_notifiers can make crashed kernel 234 * more unstable, it can increase risks of the kdump failure too. 235 * 236 * Bypass the panic_cpu check and call __crash_kexec directly. 237 */ 238 if (_crash_kexec_post_notifiers) 239 __crash_kexec(NULL); 240 241 #ifdef CONFIG_VT 242 unblank_screen(); 243 #endif 244 console_unblank(); 245 246 /* 247 * We may have ended up stopping the CPU holding the lock (in 248 * smp_send_stop()) while still having some valuable data in the console 249 * buffer. Try to acquire the lock then release it regardless of the 250 * result. The release will also print the buffers out. Locks debug 251 * should be disabled to avoid reporting bad unlock balance when 252 * panic() is not being callled from OOPS. 253 */ 254 debug_locks_off(); 255 console_flush_on_panic(); 256 257 if (!panic_blink) 258 panic_blink = no_blink; 259 260 if (panic_timeout > 0) { 261 /* 262 * Delay timeout seconds before rebooting the machine. 263 * We can't use the "normal" timers since we just panicked. 264 */ 265 pr_emerg("Rebooting in %d seconds..\n", panic_timeout); 266 267 for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) { 268 touch_nmi_watchdog(); 269 if (i >= i_next) { 270 i += panic_blink(state ^= 1); 271 i_next = i + 3600 / PANIC_BLINK_SPD; 272 } 273 mdelay(PANIC_TIMER_STEP); 274 } 275 } 276 if (panic_timeout != 0) { 277 /* 278 * This will not be a clean reboot, with everything 279 * shutting down. But if there is a chance of 280 * rebooting the system it will be rebooted. 281 */ 282 emergency_restart(); 283 } 284 #ifdef __sparc__ 285 { 286 extern int stop_a_enabled; 287 /* Make sure the user can actually press Stop-A (L1-A) */ 288 stop_a_enabled = 1; 289 pr_emerg("Press Stop-A (L1-A) from sun keyboard or send break\n" 290 "twice on console to return to the boot prom\n"); 291 } 292 #endif 293 #if defined(CONFIG_S390) 294 { 295 unsigned long caller; 296 297 caller = (unsigned long)__builtin_return_address(0); 298 disabled_wait(caller); 299 } 300 #endif 301 pr_emerg("---[ end Kernel panic - not syncing: %s ]---\n", buf); 302 local_irq_enable(); 303 for (i = 0; ; i += PANIC_TIMER_STEP) { 304 touch_softlockup_watchdog(); 305 if (i >= i_next) { 306 i += panic_blink(state ^= 1); 307 i_next = i + 3600 / PANIC_BLINK_SPD; 308 } 309 mdelay(PANIC_TIMER_STEP); 310 } 311 } 312 313 EXPORT_SYMBOL(panic); 314 315 /* 316 * TAINT_FORCED_RMMOD could be a per-module flag but the module 317 * is being removed anyway. 318 */ 319 const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = { 320 [ TAINT_PROPRIETARY_MODULE ] = { 'P', 'G', true }, 321 [ TAINT_FORCED_MODULE ] = { 'F', ' ', true }, 322 [ TAINT_CPU_OUT_OF_SPEC ] = { 'S', ' ', false }, 323 [ TAINT_FORCED_RMMOD ] = { 'R', ' ', false }, 324 [ TAINT_MACHINE_CHECK ] = { 'M', ' ', false }, 325 [ TAINT_BAD_PAGE ] = { 'B', ' ', false }, 326 [ TAINT_USER ] = { 'U', ' ', false }, 327 [ TAINT_DIE ] = { 'D', ' ', false }, 328 [ TAINT_OVERRIDDEN_ACPI_TABLE ] = { 'A', ' ', false }, 329 [ TAINT_WARN ] = { 'W', ' ', false }, 330 [ TAINT_CRAP ] = { 'C', ' ', true }, 331 [ TAINT_FIRMWARE_WORKAROUND ] = { 'I', ' ', false }, 332 [ TAINT_OOT_MODULE ] = { 'O', ' ', true }, 333 [ TAINT_UNSIGNED_MODULE ] = { 'E', ' ', true }, 334 [ TAINT_SOFTLOCKUP ] = { 'L', ' ', false }, 335 [ TAINT_LIVEPATCH ] = { 'K', ' ', true }, 336 [ TAINT_AUX ] = { 'X', ' ', true }, 337 [ TAINT_RANDSTRUCT ] = { 'T', ' ', true }, 338 }; 339 340 /** 341 * print_tainted - return a string to represent the kernel taint state. 342 * 343 * For individual taint flag meanings, see Documentation/sysctl/kernel.txt 344 * 345 * The string is overwritten by the next call to print_tainted(), 346 * but is always NULL terminated. 347 */ 348 const char *print_tainted(void) 349 { 350 static char buf[TAINT_FLAGS_COUNT + sizeof("Tainted: ")]; 351 352 BUILD_BUG_ON(ARRAY_SIZE(taint_flags) != TAINT_FLAGS_COUNT); 353 354 if (tainted_mask) { 355 char *s; 356 int i; 357 358 s = buf + sprintf(buf, "Tainted: "); 359 for (i = 0; i < TAINT_FLAGS_COUNT; i++) { 360 const struct taint_flag *t = &taint_flags[i]; 361 *s++ = test_bit(i, &tainted_mask) ? 362 t->c_true : t->c_false; 363 } 364 *s = 0; 365 } else 366 snprintf(buf, sizeof(buf), "Not tainted"); 367 368 return buf; 369 } 370 371 int test_taint(unsigned flag) 372 { 373 return test_bit(flag, &tainted_mask); 374 } 375 EXPORT_SYMBOL(test_taint); 376 377 unsigned long get_taint(void) 378 { 379 return tainted_mask; 380 } 381 382 /** 383 * add_taint: add a taint flag if not already set. 384 * @flag: one of the TAINT_* constants. 385 * @lockdep_ok: whether lock debugging is still OK. 386 * 387 * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for 388 * some notewortht-but-not-corrupting cases, it can be set to true. 389 */ 390 void add_taint(unsigned flag, enum lockdep_ok lockdep_ok) 391 { 392 if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off()) 393 pr_warn("Disabling lock debugging due to kernel taint\n"); 394 395 set_bit(flag, &tainted_mask); 396 } 397 EXPORT_SYMBOL(add_taint); 398 399 static void spin_msec(int msecs) 400 { 401 int i; 402 403 for (i = 0; i < msecs; i++) { 404 touch_nmi_watchdog(); 405 mdelay(1); 406 } 407 } 408 409 /* 410 * It just happens that oops_enter() and oops_exit() are identically 411 * implemented... 412 */ 413 static void do_oops_enter_exit(void) 414 { 415 unsigned long flags; 416 static int spin_counter; 417 418 if (!pause_on_oops) 419 return; 420 421 spin_lock_irqsave(&pause_on_oops_lock, flags); 422 if (pause_on_oops_flag == 0) { 423 /* This CPU may now print the oops message */ 424 pause_on_oops_flag = 1; 425 } else { 426 /* We need to stall this CPU */ 427 if (!spin_counter) { 428 /* This CPU gets to do the counting */ 429 spin_counter = pause_on_oops; 430 do { 431 spin_unlock(&pause_on_oops_lock); 432 spin_msec(MSEC_PER_SEC); 433 spin_lock(&pause_on_oops_lock); 434 } while (--spin_counter); 435 pause_on_oops_flag = 0; 436 } else { 437 /* This CPU waits for a different one */ 438 while (spin_counter) { 439 spin_unlock(&pause_on_oops_lock); 440 spin_msec(1); 441 spin_lock(&pause_on_oops_lock); 442 } 443 } 444 } 445 spin_unlock_irqrestore(&pause_on_oops_lock, flags); 446 } 447 448 /* 449 * Return true if the calling CPU is allowed to print oops-related info. 450 * This is a bit racy.. 451 */ 452 int oops_may_print(void) 453 { 454 return pause_on_oops_flag == 0; 455 } 456 457 /* 458 * Called when the architecture enters its oops handler, before it prints 459 * anything. If this is the first CPU to oops, and it's oopsing the first 460 * time then let it proceed. 461 * 462 * This is all enabled by the pause_on_oops kernel boot option. We do all 463 * this to ensure that oopses don't scroll off the screen. It has the 464 * side-effect of preventing later-oopsing CPUs from mucking up the display, 465 * too. 466 * 467 * It turns out that the CPU which is allowed to print ends up pausing for 468 * the right duration, whereas all the other CPUs pause for twice as long: 469 * once in oops_enter(), once in oops_exit(). 470 */ 471 void oops_enter(void) 472 { 473 tracing_off(); 474 /* can't trust the integrity of the kernel anymore: */ 475 debug_locks_off(); 476 do_oops_enter_exit(); 477 } 478 479 /* 480 * 64-bit random ID for oopses: 481 */ 482 static u64 oops_id; 483 484 static int init_oops_id(void) 485 { 486 if (!oops_id) 487 get_random_bytes(&oops_id, sizeof(oops_id)); 488 else 489 oops_id++; 490 491 return 0; 492 } 493 late_initcall(init_oops_id); 494 495 void print_oops_end_marker(void) 496 { 497 init_oops_id(); 498 pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id); 499 } 500 501 /* 502 * Called when the architecture exits its oops handler, after printing 503 * everything. 504 */ 505 void oops_exit(void) 506 { 507 do_oops_enter_exit(); 508 print_oops_end_marker(); 509 kmsg_dump(KMSG_DUMP_OOPS); 510 } 511 512 struct warn_args { 513 const char *fmt; 514 va_list args; 515 }; 516 517 void __warn(const char *file, int line, void *caller, unsigned taint, 518 struct pt_regs *regs, struct warn_args *args) 519 { 520 disable_trace_on_warning(); 521 522 if (args) 523 pr_warn(CUT_HERE); 524 525 if (file) 526 pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pS\n", 527 raw_smp_processor_id(), current->pid, file, line, 528 caller); 529 else 530 pr_warn("WARNING: CPU: %d PID: %d at %pS\n", 531 raw_smp_processor_id(), current->pid, caller); 532 533 if (args) 534 vprintk(args->fmt, args->args); 535 536 if (panic_on_warn) { 537 /* 538 * This thread may hit another WARN() in the panic path. 539 * Resetting this prevents additional WARN() from panicking the 540 * system on this thread. Other threads are blocked by the 541 * panic_mutex in panic(). 542 */ 543 panic_on_warn = 0; 544 panic("panic_on_warn set ...\n"); 545 } 546 547 print_modules(); 548 549 if (regs) 550 show_regs(regs); 551 else 552 dump_stack(); 553 554 print_irqtrace_events(current); 555 556 print_oops_end_marker(); 557 558 /* Just a warning, don't kill lockdep. */ 559 add_taint(taint, LOCKDEP_STILL_OK); 560 } 561 562 #ifdef WANT_WARN_ON_SLOWPATH 563 void warn_slowpath_fmt(const char *file, int line, const char *fmt, ...) 564 { 565 struct warn_args args; 566 567 args.fmt = fmt; 568 va_start(args.args, fmt); 569 __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, 570 &args); 571 va_end(args.args); 572 } 573 EXPORT_SYMBOL(warn_slowpath_fmt); 574 575 void warn_slowpath_fmt_taint(const char *file, int line, 576 unsigned taint, const char *fmt, ...) 577 { 578 struct warn_args args; 579 580 args.fmt = fmt; 581 va_start(args.args, fmt); 582 __warn(file, line, __builtin_return_address(0), taint, NULL, &args); 583 va_end(args.args); 584 } 585 EXPORT_SYMBOL(warn_slowpath_fmt_taint); 586 587 void warn_slowpath_null(const char *file, int line) 588 { 589 pr_warn(CUT_HERE); 590 __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, NULL); 591 } 592 EXPORT_SYMBOL(warn_slowpath_null); 593 #else 594 void __warn_printk(const char *fmt, ...) 595 { 596 va_list args; 597 598 pr_warn(CUT_HERE); 599 600 va_start(args, fmt); 601 vprintk(fmt, args); 602 va_end(args); 603 } 604 EXPORT_SYMBOL(__warn_printk); 605 #endif 606 607 #ifdef CONFIG_BUG 608 609 /* Support resetting WARN*_ONCE state */ 610 611 static int clear_warn_once_set(void *data, u64 val) 612 { 613 generic_bug_clear_once(); 614 memset(__start_once, 0, __end_once - __start_once); 615 return 0; 616 } 617 618 DEFINE_SIMPLE_ATTRIBUTE(clear_warn_once_fops, 619 NULL, 620 clear_warn_once_set, 621 "%lld\n"); 622 623 static __init int register_warn_debugfs(void) 624 { 625 /* Don't care about failure */ 626 debugfs_create_file("clear_warn_once", 0200, NULL, 627 NULL, &clear_warn_once_fops); 628 return 0; 629 } 630 631 device_initcall(register_warn_debugfs); 632 #endif 633 634 #ifdef CONFIG_STACKPROTECTOR 635 636 /* 637 * Called when gcc's -fstack-protector feature is used, and 638 * gcc detects corruption of the on-stack canary value 639 */ 640 __visible void __stack_chk_fail(void) 641 { 642 panic("stack-protector: Kernel stack is corrupted in: %pB", 643 __builtin_return_address(0)); 644 } 645 EXPORT_SYMBOL(__stack_chk_fail); 646 647 #endif 648 649 #ifdef CONFIG_ARCH_HAS_REFCOUNT 650 void refcount_error_report(struct pt_regs *regs, const char *err) 651 { 652 WARN_RATELIMIT(1, "refcount_t %s at %pB in %s[%d], uid/euid: %u/%u\n", 653 err, (void *)instruction_pointer(regs), 654 current->comm, task_pid_nr(current), 655 from_kuid_munged(&init_user_ns, current_uid()), 656 from_kuid_munged(&init_user_ns, current_euid())); 657 } 658 #endif 659 660 core_param(panic, panic_timeout, int, 0644); 661 core_param(pause_on_oops, pause_on_oops, int, 0644); 662 core_param(panic_on_warn, panic_on_warn, int, 0644); 663 core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644); 664 665 static int __init oops_setup(char *s) 666 { 667 if (!s) 668 return -EINVAL; 669 if (!strcmp(s, "panic")) 670 panic_on_oops = 1; 671 return 0; 672 } 673 early_param("oops", oops_setup); 674