the-tree/kernel/fail_function.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * fail_function.c: Function-based error injection
0004  */
0005 #include <linux/error-injection.h>
0006 #include <linux/debugfs.h>
0007 #include <linux/fault-inject.h>
0008 #include <linux/kallsyms.h>
0009 #include <linux/kprobes.h>
0010 #include <linux/module.h>
0011 #include <linux/mutex.h>
0012 #include <linux/slab.h>
0013 #include <linux/uaccess.h>
0014
0015 static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs);
0016
0017 static void fei_post_handler(struct kprobe *kp, struct pt_regs *regs,
0018                  unsigned long flags)
0019 {
0020     /*
0021      * A dummy post handler is required to prohibit optimizing, because
0022      * jump optimization does not support execution path overriding.
0023      */
0024 }
0025
0026 struct fei_attr {
0027     struct list_head list;
0028     struct kprobe kp;
0029     unsigned long retval;
0030 };
0031 static DEFINE_MUTEX(fei_lock);
0032 static LIST_HEAD(fei_attr_list);
0033 static DECLARE_FAULT_ATTR(fei_fault_attr);
0034 static struct dentry *fei_debugfs_dir;
0035
0036 static unsigned long adjust_error_retval(unsigned long addr, unsigned long retv)
0037 {
0038     switch (get_injectable_error_type(addr)) {
0039     case EI_ETYPE_NULL:
0040         return 0;
0041     case EI_ETYPE_ERRNO:
0042         if (retv < (unsigned long)-MAX_ERRNO)
0043             return (unsigned long)-EINVAL;
0044         break;
0045     case EI_ETYPE_ERRNO_NULL:
0046         if (retv != 0 && retv < (unsigned long)-MAX_ERRNO)
0047             return (unsigned long)-EINVAL;
0048         break;
0049     case EI_ETYPE_TRUE:
0050         return 1;
0051     }
0052
0053     return retv;
0054 }
0055
0056 static struct fei_attr *fei_attr_new(const char *sym, unsigned long addr)
0057 {
0058     struct fei_attr *attr;
0059
0060     attr = kzalloc(sizeof(*attr), GFP_KERNEL);
0061     if (attr) {
0062         attr->kp.symbol_name = kstrdup(sym, GFP_KERNEL);
0063         if (!attr->kp.symbol_name) {
0064             kfree(attr);
0065             return NULL;
0066         }
0067         attr->kp.pre_handler = fei_kprobe_handler;
0068         attr->kp.post_handler = fei_post_handler;
0069         attr->retval = adjust_error_retval(addr, 0);
0070         INIT_LIST_HEAD(&attr->list);
0071     }
0072     return attr;
0073 }
0074
0075 static void fei_attr_free(struct fei_attr *attr)
0076 {
0077     if (attr) {
0078         kfree(attr->kp.symbol_name);
0079         kfree(attr);
0080     }
0081 }
0082
0083 static struct fei_attr *fei_attr_lookup(const char *sym)
0084 {
0085     struct fei_attr *attr;
0086
0087     list_for_each_entry(attr, &fei_attr_list, list) {
0088         if (!strcmp(attr->kp.symbol_name, sym))
0089             return attr;
0090     }
0091
0092     return NULL;
0093 }
0094
0095 static bool fei_attr_is_valid(struct fei_attr *_attr)
0096 {
0097     struct fei_attr *attr;
0098
0099     list_for_each_entry(attr, &fei_attr_list, list) {
0100         if (attr == _attr)
0101             return true;
0102     }
0103
0104     return false;
0105 }
0106
0107 static int fei_retval_set(void *data, u64 val)
0108 {
0109     struct fei_attr *attr = data;
0110     unsigned long retv = (unsigned long)val;
0111     int err = 0;
0112
0113     mutex_lock(&fei_lock);
0114     /*
0115      * Since this operation can be done after retval file is removed,
0116      * It is safer to check the attr is still valid before accessing
0117      * its member.
0118      */
0119     if (!fei_attr_is_valid(attr)) {
0120         err = -ENOENT;
0121         goto out;
0122     }
0123
0124     if (attr->kp.addr) {
0125         if (adjust_error_retval((unsigned long)attr->kp.addr,
0126                     val) != retv)
0127             err = -EINVAL;
0128     }
0129     if (!err)
0130         attr->retval = val;
0131 out:
0132     mutex_unlock(&fei_lock);
0133
0134     return err;
0135 }
0136
0137 static int fei_retval_get(void *data, u64 *val)
0138 {
0139     struct fei_attr *attr = data;
0140     int err = 0;
0141
0142     mutex_lock(&fei_lock);
0143     /* Here we also validate @attr to ensure it still exists. */
0144     if (!fei_attr_is_valid(attr))
0145         err = -ENOENT;
0146     else
0147         *val = attr->retval;
0148     mutex_unlock(&fei_lock);
0149
0150     return err;
0151 }
0152 DEFINE_DEBUGFS_ATTRIBUTE(fei_retval_ops, fei_retval_get, fei_retval_set,
0153              "%llx\n");
0154
0155 static void fei_debugfs_add_attr(struct fei_attr *attr)
0156 {
0157     struct dentry *dir;
0158
0159     dir = debugfs_create_dir(attr->kp.symbol_name, fei_debugfs_dir);
0160
0161     debugfs_create_file("retval", 0600, dir, attr, &fei_retval_ops);
0162 }
0163
0164 static void fei_debugfs_remove_attr(struct fei_attr *attr)
0165 {
0166     struct dentry *dir;
0167
0168     dir = debugfs_lookup(attr->kp.symbol_name, fei_debugfs_dir);
0169     debugfs_remove_recursive(dir);
0170 }
0171
0172 static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs)
0173 {
0174     struct fei_attr *attr = container_of(kp, struct fei_attr, kp);
0175
0176     if (should_fail(&fei_fault_attr, 1)) {
0177         regs_set_return_value(regs, attr->retval);
0178         override_function_with_return(regs);
0179         return 1;
0180     }
0181
0182     return 0;
0183 }
0184 NOKPROBE_SYMBOL(fei_kprobe_handler)
0185
0186 static void *fei_seq_start(struct seq_file *m, loff_t *pos)
0187 {
0188     mutex_lock(&fei_lock);
0189     return seq_list_start(&fei_attr_list, *pos);
0190 }
0191
0192 static void fei_seq_stop(struct seq_file *m, void *v)
0193 {
0194     mutex_unlock(&fei_lock);
0195 }
0196
0197 static void *fei_seq_next(struct seq_file *m, void *v, loff_t *pos)
0198 {
0199     return seq_list_next(v, &fei_attr_list, pos);
0200 }
0201
0202 static int fei_seq_show(struct seq_file *m, void *v)
0203 {
0204     struct fei_attr *attr = list_entry(v, struct fei_attr, list);
0205
0206     seq_printf(m, "%ps\n", attr->kp.addr);
0207     return 0;
0208 }
0209
0210 static const struct seq_operations fei_seq_ops = {
0211     .start  = fei_seq_start,
0212     .next   = fei_seq_next,
0213     .stop   = fei_seq_stop,
0214     .show   = fei_seq_show,
0215 };
0216
0217 static int fei_open(struct inode *inode, struct file *file)
0218 {
0219     return seq_open(file, &fei_seq_ops);
0220 }
0221
0222 static void fei_attr_remove(struct fei_attr *attr)
0223 {
0224     fei_debugfs_remove_attr(attr);
0225     unregister_kprobe(&attr->kp);
0226     list_del(&attr->list);
0227     fei_attr_free(attr);
0228 }
0229
0230 static void fei_attr_remove_all(void)
0231 {
0232     struct fei_attr *attr, *n;
0233
0234     list_for_each_entry_safe(attr, n, &fei_attr_list, list) {
0235         fei_attr_remove(attr);
0236     }
0237 }
0238
0239 static ssize_t fei_write(struct file *file, const char __user *buffer,
0240              size_t count, loff_t *ppos)
0241 {
0242     struct fei_attr *attr;
0243     unsigned long addr;
0244     char *buf, *sym;
0245     int ret;
0246
0247     /* cut off if it is too long */
0248     if (count > KSYM_NAME_LEN)
0249         count = KSYM_NAME_LEN;
0250     buf = kmalloc(count + 1, GFP_KERNEL);
0251     if (!buf)
0252         return -ENOMEM;
0253
0254     if (copy_from_user(buf, buffer, count)) {
0255         ret = -EFAULT;
0256         goto out_free;
0257     }
0258     buf[count] = '\0';
0259     sym = strstrip(buf);
0260
0261     mutex_lock(&fei_lock);
0262
0263     /* Writing just spaces will remove all injection points */
0264     if (sym[0] == '\0') {
0265         fei_attr_remove_all();
0266         ret = count;
0267         goto out;
0268     }
0269     /* Writing !function will remove one injection point */
0270     if (sym[0] == '!') {
0271         attr = fei_attr_lookup(sym + 1);
0272         if (!attr) {
0273             ret = -ENOENT;
0274             goto out;
0275         }
0276         fei_attr_remove(attr);
0277         ret = count;
0278         goto out;
0279     }
0280
0281     addr = kallsyms_lookup_name(sym);
0282     if (!addr) {
0283         ret = -EINVAL;
0284         goto out;
0285     }
0286     if (!within_error_injection_list(addr)) {
0287         ret = -ERANGE;
0288         goto out;
0289     }
0290     if (fei_attr_lookup(sym)) {
0291         ret = -EBUSY;
0292         goto out;
0293     }
0294     attr = fei_attr_new(sym, addr);
0295     if (!attr) {
0296         ret = -ENOMEM;
0297         goto out;
0298     }
0299
0300     ret = register_kprobe(&attr->kp);
0301     if (!ret)
0302         fei_debugfs_add_attr(attr);
0303     if (ret < 0)
0304         fei_attr_remove(attr);
0305     else {
0306         list_add_tail(&attr->list, &fei_attr_list);
0307         ret = count;
0308     }
0309 out:
0310     mutex_unlock(&fei_lock);
0311 out_free:
0312     kfree(buf);
0313     return ret;
0314 }
0315
0316 static const struct file_operations fei_ops = {
0317     .open =     fei_open,
0318     .read =     seq_read,
0319     .write =    fei_write,
0320     .llseek =   seq_lseek,
0321     .release =  seq_release,
0322 };
0323
0324 static int __init fei_debugfs_init(void)
0325 {
0326     struct dentry *dir;
0327
0328     dir = fault_create_debugfs_attr("fail_function", NULL,
0329                     &fei_fault_attr);
0330     if (IS_ERR(dir))
0331         return PTR_ERR(dir);
0332
0333     /* injectable attribute is just a symlink of error_inject/list */
0334     debugfs_create_symlink("injectable", dir, "../error_injection/list");
0335
0336     debugfs_create_file("inject", 0600, dir, NULL, &fei_ops);
0337
0338     fei_debugfs_dir = dir;
0339
0340     return 0;
0341 }
0342
0343 late_initcall(fei_debugfs_init);