1 /* 2 * linux/kernel/panic.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * This function is used through-out the kernel (including mm and fs) 9 * to indicate a major problem. 10 */ 11 #include <linux/debug_locks.h> 12 #include <linux/sched/debug.h> 13 #include <linux/interrupt.h> 14 #include <linux/kmsg_dump.h> 15 #include <linux/kallsyms.h> 16 #include <linux/notifier.h> 17 #include <linux/module.h> 18 #include <linux/random.h> 19 #include <linux/ftrace.h> 20 #include <linux/reboot.h> 21 #include <linux/delay.h> 22 #include <linux/kexec.h> 23 #include <linux/sched.h> 24 #include <linux/sysrq.h> 25 #include <linux/init.h> 26 #include <linux/nmi.h> 27 #include <linux/console.h> 28 #include <linux/bug.h> 29 #include <linux/ratelimit.h> 30 #include <linux/debugfs.h> 31 #include <asm/sections.h> 32 33 #define PANIC_TIMER_STEP 100 34 #define PANIC_BLINK_SPD 18 35 36 int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE; 37 static unsigned long tainted_mask = 38 IS_ENABLED(CONFIG_GCC_PLUGIN_RANDSTRUCT) ? (1 << TAINT_RANDSTRUCT) : 0; 39 static int pause_on_oops; 40 static int pause_on_oops_flag; 41 static DEFINE_SPINLOCK(pause_on_oops_lock); 42 bool crash_kexec_post_notifiers; 43 int panic_on_warn __read_mostly; 44 45 int panic_timeout = CONFIG_PANIC_TIMEOUT; 46 EXPORT_SYMBOL_GPL(panic_timeout); 47 48 ATOMIC_NOTIFIER_HEAD(panic_notifier_list); 49 50 EXPORT_SYMBOL(panic_notifier_list); 51 52 static long no_blink(int state) 53 { 54 return 0; 55 } 56 57 /* Returns how long it waited in ms */ 58 long (*panic_blink)(int state); 59 EXPORT_SYMBOL(panic_blink); 60 61 /* 62 * Stop ourself in panic -- architecture code may override this 63 */ 64 void __weak panic_smp_self_stop(void) 65 { 66 while (1) 67 cpu_relax(); 68 } 69 70 /* 71 * Stop ourselves in NMI context if another CPU has already panicked. Arch code 72 * may override this to prepare for crash dumping, e.g. save regs info. 73 */ 74 void __weak nmi_panic_self_stop(struct pt_regs *regs) 75 { 76 panic_smp_self_stop(); 77 } 78 79 /* 80 * Stop other CPUs in panic. Architecture dependent code may override this 81 * with more suitable version. For example, if the architecture supports 82 * crash dump, it should save registers of each stopped CPU and disable 83 * per-CPU features such as virtualization extensions. 84 */ 85 void __weak crash_smp_send_stop(void) 86 { 87 static int cpus_stopped; 88 89 /* 90 * This function can be called twice in panic path, but obviously 91 * we execute this only once. 92 */ 93 if (cpus_stopped) 94 return; 95 96 /* 97 * Note smp_send_stop is the usual smp shutdown function, which 98 * unfortunately means it may not be hardened to work in a panic 99 * situation. 100 */ 101 smp_send_stop(); 102 cpus_stopped = 1; 103 } 104 105 atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID); 106 107 /* 108 * A variant of panic() called from NMI context. We return if we've already 109 * panicked on this CPU. If another CPU already panicked, loop in 110 * nmi_panic_self_stop() which can provide architecture dependent code such 111 * as saving register state for crash dump. 112 */ 113 void nmi_panic(struct pt_regs *regs, const char *msg) 114 { 115 int old_cpu, cpu; 116 117 cpu = raw_smp_processor_id(); 118 old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, cpu); 119 120 if (old_cpu == PANIC_CPU_INVALID) 121 panic("%s", msg); 122 else if (old_cpu != cpu) 123 nmi_panic_self_stop(regs); 124 } 125 EXPORT_SYMBOL(nmi_panic); 126 127 /** 128 * panic - halt the system 129 * @fmt: The text string to print 130 * 131 * Display a message, then perform cleanups. 132 * 133 * This function never returns. 134 */ 135 void panic(const char *fmt, ...) 136 { 137 static char buf[1024]; 138 va_list args; 139 long i, i_next = 0; 140 int state = 0; 141 int old_cpu, this_cpu; 142 bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers; 143 144 /* 145 * Disable local interrupts. This will prevent panic_smp_self_stop 146 * from deadlocking the first cpu that invokes the panic, since 147 * there is nothing to prevent an interrupt handler (that runs 148 * after setting panic_cpu) from invoking panic() again. 149 */ 150 local_irq_disable(); 151 152 /* 153 * It's possible to come here directly from a panic-assertion and 154 * not have preempt disabled. Some functions called from here want 155 * preempt to be disabled. No point enabling it later though... 156 * 157 * Only one CPU is allowed to execute the panic code from here. For 158 * multiple parallel invocations of panic, all other CPUs either 159 * stop themself or will wait until they are stopped by the 1st CPU 160 * with smp_send_stop(). 161 * 162 * `old_cpu == PANIC_CPU_INVALID' means this is the 1st CPU which 163 * comes here, so go ahead. 164 * `old_cpu == this_cpu' means we came from nmi_panic() which sets 165 * panic_cpu to this CPU. In this case, this is also the 1st CPU. 166 */ 167 this_cpu = raw_smp_processor_id(); 168 old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, this_cpu); 169 170 if (old_cpu != PANIC_CPU_INVALID && old_cpu != this_cpu) 171 panic_smp_self_stop(); 172 173 console_verbose(); 174 bust_spinlocks(1); 175 va_start(args, fmt); 176 vsnprintf(buf, sizeof(buf), fmt, args); 177 va_end(args); 178 pr_emerg("Kernel panic - not syncing: %s\n", buf); 179 #ifdef CONFIG_DEBUG_BUGVERBOSE 180 /* 181 * Avoid nested stack-dumping if a panic occurs during oops processing 182 */ 183 if (!test_taint(TAINT_DIE) && oops_in_progress <= 1) 184 dump_stack(); 185 #endif 186 187 /* 188 * If we have crashed and we have a crash kernel loaded let it handle 189 * everything else. 190 * If we want to run this after calling panic_notifiers, pass 191 * the "crash_kexec_post_notifiers" option to the kernel. 192 * 193 * Bypass the panic_cpu check and call __crash_kexec directly. 194 */ 195 if (!_crash_kexec_post_notifiers) { 196 printk_safe_flush_on_panic(); 197 __crash_kexec(NULL); 198 199 /* 200 * Note smp_send_stop is the usual smp shutdown function, which 201 * unfortunately means it may not be hardened to work in a 202 * panic situation. 203 */ 204 smp_send_stop(); 205 } else { 206 /* 207 * If we want to do crash dump after notifier calls and 208 * kmsg_dump, we will need architecture dependent extra 209 * works in addition to stopping other CPUs. 210 */ 211 crash_smp_send_stop(); 212 } 213 214 /* 215 * Run any panic handlers, including those that might need to 216 * add information to the kmsg dump output. 217 */ 218 atomic_notifier_call_chain(&panic_notifier_list, 0, buf); 219 220 /* Call flush even twice. It tries harder with a single online CPU */ 221 printk_safe_flush_on_panic(); 222 kmsg_dump(KMSG_DUMP_PANIC); 223 224 /* 225 * If you doubt kdump always works fine in any situation, 226 * "crash_kexec_post_notifiers" offers you a chance to run 227 * panic_notifiers and dumping kmsg before kdump. 228 * Note: since some panic_notifiers can make crashed kernel 229 * more unstable, it can increase risks of the kdump failure too. 230 * 231 * Bypass the panic_cpu check and call __crash_kexec directly. 232 */ 233 if (_crash_kexec_post_notifiers) 234 __crash_kexec(NULL); 235 236 bust_spinlocks(0); 237 238 /* 239 * We may have ended up stopping the CPU holding the lock (in 240 * smp_send_stop()) while still having some valuable data in the console 241 * buffer. Try to acquire the lock then release it regardless of the 242 * result. The release will also print the buffers out. Locks debug 243 * should be disabled to avoid reporting bad unlock balance when 244 * panic() is not being callled from OOPS. 245 */ 246 debug_locks_off(); 247 console_flush_on_panic(); 248 249 if (!panic_blink) 250 panic_blink = no_blink; 251 252 if (panic_timeout > 0) { 253 /* 254 * Delay timeout seconds before rebooting the machine. 255 * We can't use the "normal" timers since we just panicked. 256 */ 257 pr_emerg("Rebooting in %d seconds..\n", panic_timeout); 258 259 for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) { 260 touch_nmi_watchdog(); 261 if (i >= i_next) { 262 i += panic_blink(state ^= 1); 263 i_next = i + 3600 / PANIC_BLINK_SPD; 264 } 265 mdelay(PANIC_TIMER_STEP); 266 } 267 } 268 if (panic_timeout != 0) { 269 /* 270 * This will not be a clean reboot, with everything 271 * shutting down. But if there is a chance of 272 * rebooting the system it will be rebooted. 273 */ 274 emergency_restart(); 275 } 276 #ifdef __sparc__ 277 { 278 extern int stop_a_enabled; 279 /* Make sure the user can actually press Stop-A (L1-A) */ 280 stop_a_enabled = 1; 281 pr_emerg("Press Stop-A (L1-A) from sun keyboard or send break\n" 282 "twice on console to return to the boot prom\n"); 283 } 284 #endif 285 #if defined(CONFIG_S390) 286 { 287 unsigned long caller; 288 289 caller = (unsigned long)__builtin_return_address(0); 290 disabled_wait(caller); 291 } 292 #endif 293 pr_emerg("---[ end Kernel panic - not syncing: %s ]---\n", buf); 294 local_irq_enable(); 295 for (i = 0; ; i += PANIC_TIMER_STEP) { 296 touch_softlockup_watchdog(); 297 if (i >= i_next) { 298 i += panic_blink(state ^= 1); 299 i_next = i + 3600 / PANIC_BLINK_SPD; 300 } 301 mdelay(PANIC_TIMER_STEP); 302 } 303 } 304 305 EXPORT_SYMBOL(panic); 306 307 /* 308 * TAINT_FORCED_RMMOD could be a per-module flag but the module 309 * is being removed anyway. 310 */ 311 const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = { 312 [ TAINT_PROPRIETARY_MODULE ] = { 'P', 'G', true }, 313 [ TAINT_FORCED_MODULE ] = { 'F', ' ', true }, 314 [ TAINT_CPU_OUT_OF_SPEC ] = { 'S', ' ', false }, 315 [ TAINT_FORCED_RMMOD ] = { 'R', ' ', false }, 316 [ TAINT_MACHINE_CHECK ] = { 'M', ' ', false }, 317 [ TAINT_BAD_PAGE ] = { 'B', ' ', false }, 318 [ TAINT_USER ] = { 'U', ' ', false }, 319 [ TAINT_DIE ] = { 'D', ' ', false }, 320 [ TAINT_OVERRIDDEN_ACPI_TABLE ] = { 'A', ' ', false }, 321 [ TAINT_WARN ] = { 'W', ' ', false }, 322 [ TAINT_CRAP ] = { 'C', ' ', true }, 323 [ TAINT_FIRMWARE_WORKAROUND ] = { 'I', ' ', false }, 324 [ TAINT_OOT_MODULE ] = { 'O', ' ', true }, 325 [ TAINT_UNSIGNED_MODULE ] = { 'E', ' ', true }, 326 [ TAINT_SOFTLOCKUP ] = { 'L', ' ', false }, 327 [ TAINT_LIVEPATCH ] = { 'K', ' ', true }, 328 [ TAINT_AUX ] = { 'X', ' ', true }, 329 [ TAINT_RANDSTRUCT ] = { 'T', ' ', true }, 330 }; 331 332 /** 333 * print_tainted - return a string to represent the kernel taint state. 334 * 335 * For individual taint flag meanings, see Documentation/sysctl/kernel.txt 336 * 337 * The string is overwritten by the next call to print_tainted(), 338 * but is always NULL terminated. 339 */ 340 const char *print_tainted(void) 341 { 342 static char buf[TAINT_FLAGS_COUNT + sizeof("Tainted: ")]; 343 344 BUILD_BUG_ON(ARRAY_SIZE(taint_flags) != TAINT_FLAGS_COUNT); 345 346 if (tainted_mask) { 347 char *s; 348 int i; 349 350 s = buf + sprintf(buf, "Tainted: "); 351 for (i = 0; i < TAINT_FLAGS_COUNT; i++) { 352 const struct taint_flag *t = &taint_flags[i]; 353 *s++ = test_bit(i, &tainted_mask) ? 354 t->c_true : t->c_false; 355 } 356 *s = 0; 357 } else 358 snprintf(buf, sizeof(buf), "Not tainted"); 359 360 return buf; 361 } 362 363 int test_taint(unsigned flag) 364 { 365 return test_bit(flag, &tainted_mask); 366 } 367 EXPORT_SYMBOL(test_taint); 368 369 unsigned long get_taint(void) 370 { 371 return tainted_mask; 372 } 373 374 /** 375 * add_taint: add a taint flag if not already set. 376 * @flag: one of the TAINT_* constants. 377 * @lockdep_ok: whether lock debugging is still OK. 378 * 379 * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for 380 * some notewortht-but-not-corrupting cases, it can be set to true. 381 */ 382 void add_taint(unsigned flag, enum lockdep_ok lockdep_ok) 383 { 384 if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off()) 385 pr_warn("Disabling lock debugging due to kernel taint\n"); 386 387 set_bit(flag, &tainted_mask); 388 } 389 EXPORT_SYMBOL(add_taint); 390 391 static void spin_msec(int msecs) 392 { 393 int i; 394 395 for (i = 0; i < msecs; i++) { 396 touch_nmi_watchdog(); 397 mdelay(1); 398 } 399 } 400 401 /* 402 * It just happens that oops_enter() and oops_exit() are identically 403 * implemented... 404 */ 405 static void do_oops_enter_exit(void) 406 { 407 unsigned long flags; 408 static int spin_counter; 409 410 if (!pause_on_oops) 411 return; 412 413 spin_lock_irqsave(&pause_on_oops_lock, flags); 414 if (pause_on_oops_flag == 0) { 415 /* This CPU may now print the oops message */ 416 pause_on_oops_flag = 1; 417 } else { 418 /* We need to stall this CPU */ 419 if (!spin_counter) { 420 /* This CPU gets to do the counting */ 421 spin_counter = pause_on_oops; 422 do { 423 spin_unlock(&pause_on_oops_lock); 424 spin_msec(MSEC_PER_SEC); 425 spin_lock(&pause_on_oops_lock); 426 } while (--spin_counter); 427 pause_on_oops_flag = 0; 428 } else { 429 /* This CPU waits for a different one */ 430 while (spin_counter) { 431 spin_unlock(&pause_on_oops_lock); 432 spin_msec(1); 433 spin_lock(&pause_on_oops_lock); 434 } 435 } 436 } 437 spin_unlock_irqrestore(&pause_on_oops_lock, flags); 438 } 439 440 /* 441 * Return true if the calling CPU is allowed to print oops-related info. 442 * This is a bit racy.. 443 */ 444 int oops_may_print(void) 445 { 446 return pause_on_oops_flag == 0; 447 } 448 449 /* 450 * Called when the architecture enters its oops handler, before it prints 451 * anything. If this is the first CPU to oops, and it's oopsing the first 452 * time then let it proceed. 453 * 454 * This is all enabled by the pause_on_oops kernel boot option. We do all 455 * this to ensure that oopses don't scroll off the screen. It has the 456 * side-effect of preventing later-oopsing CPUs from mucking up the display, 457 * too. 458 * 459 * It turns out that the CPU which is allowed to print ends up pausing for 460 * the right duration, whereas all the other CPUs pause for twice as long: 461 * once in oops_enter(), once in oops_exit(). 462 */ 463 void oops_enter(void) 464 { 465 tracing_off(); 466 /* can't trust the integrity of the kernel anymore: */ 467 debug_locks_off(); 468 do_oops_enter_exit(); 469 } 470 471 /* 472 * 64-bit random ID for oopses: 473 */ 474 static u64 oops_id; 475 476 static int init_oops_id(void) 477 { 478 if (!oops_id) 479 get_random_bytes(&oops_id, sizeof(oops_id)); 480 else 481 oops_id++; 482 483 return 0; 484 } 485 late_initcall(init_oops_id); 486 487 void print_oops_end_marker(void) 488 { 489 init_oops_id(); 490 pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id); 491 } 492 493 /* 494 * Called when the architecture exits its oops handler, after printing 495 * everything. 496 */ 497 void oops_exit(void) 498 { 499 do_oops_enter_exit(); 500 print_oops_end_marker(); 501 kmsg_dump(KMSG_DUMP_OOPS); 502 } 503 504 struct warn_args { 505 const char *fmt; 506 va_list args; 507 }; 508 509 void __warn(const char *file, int line, void *caller, unsigned taint, 510 struct pt_regs *regs, struct warn_args *args) 511 { 512 disable_trace_on_warning(); 513 514 if (args) 515 pr_warn(CUT_HERE); 516 517 if (file) 518 pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pS\n", 519 raw_smp_processor_id(), current->pid, file, line, 520 caller); 521 else 522 pr_warn("WARNING: CPU: %d PID: %d at %pS\n", 523 raw_smp_processor_id(), current->pid, caller); 524 525 if (args) 526 vprintk(args->fmt, args->args); 527 528 if (panic_on_warn) { 529 /* 530 * This thread may hit another WARN() in the panic path. 531 * Resetting this prevents additional WARN() from panicking the 532 * system on this thread. Other threads are blocked by the 533 * panic_mutex in panic(). 534 */ 535 panic_on_warn = 0; 536 panic("panic_on_warn set ...\n"); 537 } 538 539 print_modules(); 540 541 if (regs) 542 show_regs(regs); 543 else 544 dump_stack(); 545 546 print_irqtrace_events(current); 547 548 print_oops_end_marker(); 549 550 /* Just a warning, don't kill lockdep. */ 551 add_taint(taint, LOCKDEP_STILL_OK); 552 } 553 554 #ifdef WANT_WARN_ON_SLOWPATH 555 void warn_slowpath_fmt(const char *file, int line, const char *fmt, ...) 556 { 557 struct warn_args args; 558 559 args.fmt = fmt; 560 va_start(args.args, fmt); 561 __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, 562 &args); 563 va_end(args.args); 564 } 565 EXPORT_SYMBOL(warn_slowpath_fmt); 566 567 void warn_slowpath_fmt_taint(const char *file, int line, 568 unsigned taint, const char *fmt, ...) 569 { 570 struct warn_args args; 571 572 args.fmt = fmt; 573 va_start(args.args, fmt); 574 __warn(file, line, __builtin_return_address(0), taint, NULL, &args); 575 va_end(args.args); 576 } 577 EXPORT_SYMBOL(warn_slowpath_fmt_taint); 578 579 void warn_slowpath_null(const char *file, int line) 580 { 581 pr_warn(CUT_HERE); 582 __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, NULL); 583 } 584 EXPORT_SYMBOL(warn_slowpath_null); 585 #else 586 void __warn_printk(const char *fmt, ...) 587 { 588 va_list args; 589 590 pr_warn(CUT_HERE); 591 592 va_start(args, fmt); 593 vprintk(fmt, args); 594 va_end(args); 595 } 596 EXPORT_SYMBOL(__warn_printk); 597 #endif 598 599 #ifdef CONFIG_BUG 600 601 /* Support resetting WARN*_ONCE state */ 602 603 static int clear_warn_once_set(void *data, u64 val) 604 { 605 generic_bug_clear_once(); 606 memset(__start_once, 0, __end_once - __start_once); 607 return 0; 608 } 609 610 DEFINE_SIMPLE_ATTRIBUTE(clear_warn_once_fops, 611 NULL, 612 clear_warn_once_set, 613 "%lld\n"); 614 615 static __init int register_warn_debugfs(void) 616 { 617 /* Don't care about failure */ 618 debugfs_create_file("clear_warn_once", 0200, NULL, 619 NULL, &clear_warn_once_fops); 620 return 0; 621 } 622 623 device_initcall(register_warn_debugfs); 624 #endif 625 626 #ifdef CONFIG_STACKPROTECTOR 627 628 /* 629 * Called when gcc's -fstack-protector feature is used, and 630 * gcc detects corruption of the on-stack canary value 631 */ 632 __visible void __stack_chk_fail(void) 633 { 634 panic("stack-protector: Kernel stack is corrupted in: %pB\n", 635 __builtin_return_address(0)); 636 } 637 EXPORT_SYMBOL(__stack_chk_fail); 638 639 #endif 640 641 #ifdef CONFIG_ARCH_HAS_REFCOUNT 642 void refcount_error_report(struct pt_regs *regs, const char *err) 643 { 644 WARN_RATELIMIT(1, "refcount_t %s at %pB in %s[%d], uid/euid: %u/%u\n", 645 err, (void *)instruction_pointer(regs), 646 current->comm, task_pid_nr(current), 647 from_kuid_munged(&init_user_ns, current_uid()), 648 from_kuid_munged(&init_user_ns, current_euid())); 649 } 650 #endif 651 652 core_param(panic, panic_timeout, int, 0644); 653 core_param(pause_on_oops, pause_on_oops, int, 0644); 654 core_param(panic_on_warn, panic_on_warn, int, 0644); 655 core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644); 656 657 static int __init oops_setup(char *s) 658 { 659 if (!s) 660 return -EINVAL; 661 if (!strcmp(s, "panic")) 662 panic_on_oops = 1; 663 return 0; 664 } 665 early_param("oops", oops_setup); 666