b290df0681
Function ll_rw_block was removed in commit79f5978420("fs/buffer: remove ll_rw_block() helper"). There is no unified function to sumbit read or write buffer in block layer for now. Consider similar sematics, we can choose submit_bh() to replace ll_rw_block() as predefined crash point. In submit_bh(), it also takes read or write flag as the first argument and invoke submit_bio() to submit I/O request to block layer. Fixes:79f5978420("fs/buffer: remove ll_rw_block() helper") Signed-off-by: Yue Zhao <findns94@gmail.com> Acked-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230503162944.3969-1-findns94@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
58 lines
2.3 KiB
ReStructuredText
58 lines
2.3 KiB
ReStructuredText
.. SPDX-License-Identifier: GPL-2.0
|
|
|
|
============================================================
|
|
Provoking crashes with Linux Kernel Dump Test Module (LKDTM)
|
|
============================================================
|
|
|
|
The lkdtm module provides an interface to disrupt (and usually crash)
|
|
the kernel at predefined code locations to evaluate the reliability of
|
|
the kernel's exception handling and to test crash dumps obtained using
|
|
different dumping solutions. The module uses KPROBEs to instrument the
|
|
trigger location, but can also trigger the kernel directly without KPROBE
|
|
support via debugfs.
|
|
|
|
You can select the location of the trigger ("crash point name") and the
|
|
type of action ("crash point type") either through module arguments when
|
|
inserting the module, or through the debugfs interface.
|
|
|
|
Usage::
|
|
|
|
insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
|
|
[cpoint_count={>0}]
|
|
|
|
recur_count
|
|
Recursion level for the stack overflow test. By default this is
|
|
dynamically calculated based on kernel configuration, with the
|
|
goal of being just large enough to exhaust the kernel stack. The
|
|
value can be seen at `/sys/module/lkdtm/parameters/recur_count`.
|
|
|
|
cpoint_name
|
|
Where in the kernel to trigger the action. It can be
|
|
one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
|
|
FS_SUBMIT_BH, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
|
|
|
|
cpoint_type
|
|
Indicates the action to be taken on hitting the crash point.
|
|
These are numerous, and best queried directly from debugfs. Some
|
|
of the common ones are PANIC, BUG, EXCEPTION, LOOP, and OVERFLOW.
|
|
See the contents of `/sys/kernel/debug/provoke-crash/DIRECT` for
|
|
a complete list.
|
|
|
|
cpoint_count
|
|
Indicates the number of times the crash point is to be hit
|
|
before triggering the action. The default is 10 (except for
|
|
DIRECT, which always fires immediately).
|
|
|
|
You can also induce failures by mounting debugfs and writing the type to
|
|
<debugfs>/provoke-crash/<crashpoint>. E.g.::
|
|
|
|
mount -t debugfs debugfs /sys/kernel/debug
|
|
echo EXCEPTION > /sys/kernel/debug/provoke-crash/INT_HARDWARE_ENTRY
|
|
|
|
The special file `DIRECT` will induce the action directly without KPROBE
|
|
instrumentation. This mode is the only one available when the module is
|
|
built for a kernel without KPROBEs support::
|
|
|
|
# Instead of having a BUG kill your shell, have it kill "cat":
|
|
cat <(echo WRITE_RO) >/sys/kernel/debug/provoke-crash/DIRECT
|