5fd5fbe20d
* refs/heads/tmp-ead6fb7: Revert "spi: uniphier: fix incorrect property items" Linux 4.19.87 PM / devfreq: Fix kernel oops on governor module load KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel powerpc/book3s64: Fix link stack flush on context switch powerpc/64s: support nospectre_v2 cmdline option staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error USB: serial: option: add support for Foxconn T77W968 LTE modules USB: serial: option: add support for DW5821e with eSIM support USB: serial: mos7840: fix remote wakeup USB: serial: mos7720: fix remote wakeup USB: serial: mos7840: add USB ID to support Moxa UPort 2210 appledisplay: fix error handling in the scheduled work USB: chaoskey: fix error case of a timeout usb-serial: cp201x: support Mark-10 digital force gauge usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit() usbip: tools: fix fd leakage in the function of read_attr_usbip_status USBIP: add config dependency for SGL_ALLOC virtio_ring: fix return code on DMA mapping fails media: imon: invalid dereference in imon_touch_event media: cxusb: detect cxusb_ctrl_msg error in query media: b2c2-flexcop-usb: add sanity checking media: uvcvideo: Fix error path in control parsing failure cpufreq: Add NULL checks to show() and store() methods of cpufreq media: usbvision: Fix races among open, close, and disconnect media: vivid: Fix wrong locking that causes race conditions on streaming stop media: vivid: Set vid_cap_streaming and vid_out_streaming to true nfc: port100: handle command failure cleanly ALSA: usb-audio: Fix NULL dereference at parsing BADD futex: Prevent robust futex exit race y2038: futex: Move compat implementation into futex.c nbd: prevent memory leak x86/speculation: Fix redundant MDS mitigation message x86/speculation: Fix incorrect MDS/TAA mitigation status x86/insn: Fix awk regexp warnings ARC: perf: Accommodate big-endian CPU ARM: 8904/1: skip nomap memblocks while finding the lowmem/highmem boundary ocfs2: remove ocfs2_is_o2cb_active() net: phy: dp83867: increase SGMII autoneg timer duration net: phy: dp83867: fix speed 10 in sgmii mode mm/memory_hotplug: don't access uninitialized memmaps in shrink_zone_span() md/raid10: prevent access of uninitialized resync_pages offset ath9k_hw: fix uninitialized variable data ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved Bluetooth: Fix invalid-free in bcsp_close() mm/page_io.c: do not free shared swap slots cfg80211: call disconnect_wk when AP stops ipv6: Fix handling of LLA with VRF and sockets bound to VRF mm/memory_hotplug: Do not unlock when fails to take the device_hotplug_lock i2c: uniphier-f: fix timeout error after reading 8 bytes spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch nvme-pci: fix surprise removal PCI: keystone: Use quirk to limit MRRS for K2G pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT pinctrl: bcm2835: Use define directive for BCM2835_PINCONF_PARAM_PULL pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues cfg80211: Prevent regulatory restore during STA disconnect in concurrent interfaces tools: bpftool: pass an argument to silence open_obj_pinned() of: unittest: initialize args before calling of_*parse_*() of: unittest: allow base devicetree to have symbol metadata net: bcmgenet: return correct value 'ret' from bcmgenet_power_down ACPICA: Use %d for signed int print formatting instead of %u clk: tegra20: Turn EMC clock gate into divider vrf: mark skb for multicast or link-local as enslaved to VRF dlm: don't leak kernel pointer to userspace dlm: fix invalid free usb: typec: tcpm: charge current handling for sink during hard reset scsi: lpfc: Correct loss of fc4 type on remote port address change scsi: lpfc: Fix odd recovery in duplicate FLOGIs in point-to-point scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces scsi: megaraid_sas: Fix goto labels in error handling scsi: megaraid_sas: Fix msleep granularity scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11 scsi: mpt3sas: Don't modify EEDPTagMode field setting on SAS3.5 HBA devices scsi: mpt3sas: Fix Sync cache command failure during driver unload net: dsa: bcm_sf2: Turn on PHY to allow successful registration rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information wireless: airo: potential buffer overflow in sprintf() brcmsmac: never log "tid x is not agg'able" by default rtl8xxxu: Fix missing break in switch wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()' ath10k: snoc: fix unbalanced clock error handling wil6210: fix locking in wmi_call wil6210: fix RGF_CAF_ICR address for Talyn-MB wil6210: fix L2 RX status handling wil6210: fix debugfs memory access alignment btrfs: avoid link error with CONFIG_NO_AUTO_INLINE media: ov13858: Check for possible null pointer nds32: Fix bug in bitfield.h net: bpfilter: fix iptables failure if bpfilter_umh is disabled sock_diag: fix autoloading of the raw_diag module audit: print empty EXECVE args soc: bcm: brcmstb: Fix re-entry point with a THUMB2_KERNEL clk: sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock ARM: dts: imx6sx-sdb: Fix enet phy regulator openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS sched/fair: Don't increase sd->balance_interval on newidle balance sched/topology: Fix off by one bug net: do not abort bulk send on BQL status ocfs2: fix clusters leak in ocfs2_defrag_extent() ocfs2: don't put and assigning null to bh allocated outside ocfs2: don't use iocb when EIOCBQUEUED returns ocfs2: without quota support, avoid calling quota recovery mm: handle no memcg case in memcg_kmem_charge() properly tools/power turbosat: fix AMD APIC-id output arm64: makefile fix build of .i file in external module case nvme-pci: fix conflicting p2p resource adds irq/matrix: Fix memory overallocation ntb: intel: fix return value for ndev_vec_mask() ntb_netdev: fix sleep time mismatch net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read net: hns3: bugfix for is_valid_csq_clean_head() net: hns3: bugfix for reporting unknown vector0 interrupt repeatly problem net: hns3: bugfix for buffer not free problem during resetting fm10k: ensure completer aborts are marked as non-fatal after a resume igb: shorten maximum PHC timecounter update interval powerpc/powernv: hold device_hotplug_lock when calling device_online() mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock mm/memory_hotplug: make add_memory() take the device_hotplug_lock kernel/panic.c: do not append newline to the stack protector panic string fs/hfs/extent.c: fix array out of bounds read of array extent hfs: update timestamp on truncate() hfsplus: update timestamps on truncate() hfs: fix return value of hfs_get_block() hfsplus: fix return value of hfsplus_get_block() hfs: prevent btree data loss on ENOSPC hfsplus: prevent btree data loss on ENOSPC hfs: fix BUG on bnode parent update hfsplus: fix BUG on bnode parent update lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf linux/bitmap.h: fix type of nbits in bitmap_shift_right() linux/bitmap.h: handle constant zero-size bitmaps correctly mm/gup_benchmark.c: prevent integer overflow in ioctl block: call rq_qos_exit() after queue is frozen selftests/powerpc/cache_shape: Fix out-of-tree build selftests/powerpc/switch_endian: Fix out-of-tree build selftests/powerpc/signal: Fix out-of-tree build selftests/powerpc/ptrace: Fix out-of-tree build powerpc/xmon: Relax frame size for clang ipv4/igmp: fix v1/v2 switchback timeout based on rfc3376, 8.12 vfs: avoid problematic remapping requests into partial EOF block um: Make line/tty semantics use true write IRQ i2c: uniphier-f: fix race condition when IRQ is cleared i2c: uniphier-f: fix occasional timeout error i2c: uniphier-f: make driver robust against concurrency block: fix the DISCARD request merge macsec: let the administrator set UP state even if lowerdev is down macsec: update operstate when lower device changes mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition tools/testing/selftests/vm/gup_benchmark.c: fix 'write' flag usage mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle() arm64: lib: use C string functions with KASAN enabled sparc64: Rework xchg() definition to avoid warnings. powerpc/process: Fix flush_all_to_thread for SPE bpf, btf: fix a missing check bug in btf_parse bpf: devmap: fix wrong interface selection in notifier_call net: ethernet: cadence: fix socket buffer corruption problem thermal: rcar_thermal: Prevent hardware access during system suspend thermal: rcar_thermal: fix duplicate IRQ request selftests: fix warning: "_GNU_SOURCE" redefined selftests: kvm: Fix -Wformat warnings selftests: watchdog: Fix error message. selftests: watchdog: fix message when /dev/watchdog open fails selftests/ftrace: Fix to test kprobe $comm arg only if available spi: uniphier: fix incorrect property items fs/cifs: fix uninitialised variable warnings net: socionext: Stop PHY before resetting netsec mfd: max8997: Enale irq-wakeup unconditionally mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values mfd: arizona: Correct calling of runtime_put_sync net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode qlcnic: fix a return in qlcnic_dcb_get_capability() mISDN: Fix type of switch control variable in ctrl_teimanager f2fs: spread f2fs_set_inode_flags() f2fs: fix to spread clear_cold_data() thermal: armada: fix a test in probe() RISC-V: Avoid corrupting the upper 32-bit of phys_addr_t in ioremap rtc: s35390a: Change buf's type to u8 in s35390a_init ceph: only allow punch hole mode in fallocate ceph: fix dentry leak in ceph_readdir_prepopulate tools: bpftool: fix completion for "bpftool map update" selftests/bpf: fix return value comparison for tests in test_libbpf.sh powerpc/64s/radix: Fix radix__flush_tlb_collapsed_pmd double flushing pmd powerpc/mm/radix: Fix small page at boundary when splitting powerpc/mm/radix: Fix overuse of small pages in splitting logic powerpc/mm/radix: Fix off-by-one in split mapping logic powerpc/pseries: Export raw per-CPU VPA data via debugfs scsi: hisi_sas: Fix NULL pointer dereference sparc: Fix parport build warnings. x86/intel_rdt: Prevent pseudo-locking from using stale pointers spi: omap2-mcspi: Set FIFO DMA trigger level to word length swiotlb: do not panic on mapping failures s390/perf: Return error when debug_register fails atm: zatm: Fix empty body Clang warnings sunrpc: safely reallow resvport min/max inversion SUNRPC: Fix a compile warning for cmpxchg64() selftests/bpf: fix file resource leak in load_kallsyms dm raid: avoid bitmap with raid4/5/6 journal device sctp: use sk_wmem_queued to check for writable space usbip: tools: fix atoi() on non-null terminated string USB: misc: appledisplay: fix backlight update_status return code PCI: vmd: Detach resources after stopping root bus macintosh/windfarm_smu_sat: Fix debug output ALSA: i2c/cs8427: Fix int to char conversion PM / Domains: Deal with multiple states but no governor in genpd ACPI / scan: Create platform device for INT33FE ACPI nodes kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack xfs: clear ail delwri queued bufs on unmount of shutdown fs xfs: fix use-after-free race in xfs_buf_rele net: ena: Fix Kconfig dependency on X86 net: fix warning in af_unix net: dsa: mv88e6xxx: Fix 88E6141/6341 2500mbps SERDES speed scsi: zorro_esp: Limit DMA transfers to 65535 bytes scsi: dc395x: fix DMA API usage in sg_update_list scsi: dc395x: fix dma API usage in srb_done ASoC: tegra_sgtl5000: fix device_node refcounting clk: at91: audio-pll: fix audio pmc type clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk PCI: mediatek: Fixup MSI enablement logic by enabling MSI before clocks nvme-pci: fix hot removal during error handling nvmet-fcloop: suppress a compiler warning nvmet: avoid integer overflow in the discard code crypto: ccree - avoid implicit enum conversion scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param scsi: bfa: Avoid implicit enum conversion in bfad_im_post_vendor_event scsi: isci: Change sci_controller_start_task's return type to sci_status scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler clk: tegra: Fixes for MBIST work around KVM/x86: Fix invvpid and invept register operand size in 64-bit mode KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode() KVM: nVMX: reset cache/shadows when switching loaded VMCS nfp: bpf: protect against mis-initializing atomic counters scsi: ips: fix missing break in switch qed: Align local and global PTT to propagate through the APIs. amiflop: clean up on errors during setup pwm: lpss: Only set update bit if we are actually changing the settings pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()' RDMA/bnxt_re: Avoid resource leak in case the NQ registration fails RDMA/bnxt_re: Fix qp async event reporting RDMA/bnxt_re: Avoid NULL check after accessing the pointer scsi: hisi_sas: Free slot later in slot_complete_vx_hw() scsi: hisi_sas: Fix the race between IO completion and timeout for SMP/internal IO scsi: hisi_sas: Feed back linkrate(max/min) when re-attached m68k: fix command-line parsing when passed from u-boot w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size). misc: mic: fix a DMA pool free failure gsmi: Fix bug in append_to_eventlog sysfs handler btrfs: handle error of get_old_root btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag PCI: mediatek: Fix class type for MT7622 to PCI_CLASS_BRIDGE_PCI mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail mmc: mediatek: fill the actual clock for mmc debugfs spi: sh-msiof: fix deferred probing cdrom: don't attempt to fiddle with cdo->capability skd: fixup usage of legacy IO API ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem ath10k: set probe request oui during driver start brcmsmac: AP mode: update beacon when TIM changes mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assoc mt76: do not store aggregation sequence number for null-data frames EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field powerpc/eeh: Fix null deref for devices removed during EEH powerpc/boot: Disable vector instructions powerpc/boot: Fix opal console in boot wrapper powerpc: Fix signedness bug in update_flash_db() synclink_gt(): fix compat_ioctl() pty: fix compat ioctls gfs2: Fix marking bitmaps non-full PCI: cadence: Write MSI data with 32bits pinctrl: madera: Fix uninitialized variable bug in madera_mux_set_mux printk: fix integer overflow in setup_log_buf() printk: lock/unlock console only for new logbuf entries crypto: testmgr - fix sizeof() on COMP_BUF_SIZE ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback mwifiex: Fix NL80211_TX_POWER_LIMITED drm/i915/userptr: Try to acquire the page lock around set_page_dirty() drm/i915/pmu: "Frequency" is reported as accumulated cycles drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" virtio_console: allocate inbufs in add_port() only if it is needed nbd:fix memory leak in nbd_get_socket() tools: gpio: Correctly add make dependencies for gpio_utils gpio: max77620: Fixup debounce delays vhost/vsock: split packets to send using multiple buffers net/mlx5: Fix auto group size calculation net/mlxfw: Verify FSM error code translation doesn't exceed array size net/mlx5e: Fix set vf link state error flow sfc: Only cancel the PPS workqueue if it exists net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key net/sched: act_pedit: fix WARN() in the traffic path net: rtnetlink: prevent underflows in do_setvfinfo() net/mlx4_en: Fix wrong limitation for number of TX rings net/mlx4_en: fix mlx4 ethtool -N insertion mlxsw: spectrum_router: Fix determining underlay for a GRE tunnel Conflicts: block/blk-merge.c drivers/net/wireless/ath/wil6210/main.c drivers/pinctrl/qcom/pinctrl-spmi-gpio.c Change-Id: I2055f0bc1eb4ac6b7ade99e91f84bf2e4f4ea7c4 Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
674 lines
17 KiB
C
674 lines
17 KiB
C
/*
|
|
* linux/kernel/panic.c
|
|
*
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
*/
|
|
|
|
/*
|
|
* This function is used through-out the kernel (including mm and fs)
|
|
* to indicate a major problem.
|
|
*/
|
|
#include <linux/debug_locks.h>
|
|
#include <linux/sched/debug.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/kmsg_dump.h>
|
|
#include <linux/kallsyms.h>
|
|
#include <linux/notifier.h>
|
|
#include <linux/vt_kern.h>
|
|
#include <linux/module.h>
|
|
#include <linux/random.h>
|
|
#include <linux/ftrace.h>
|
|
#include <linux/reboot.h>
|
|
#include <linux/delay.h>
|
|
#include <linux/kexec.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/sysrq.h>
|
|
#include <linux/init.h>
|
|
#include <linux/nmi.h>
|
|
#include <linux/console.h>
|
|
#include <linux/bug.h>
|
|
#include <linux/ratelimit.h>
|
|
#include <linux/debugfs.h>
|
|
#include <asm/sections.h>
|
|
#include <soc/qcom/minidump.h>
|
|
|
|
#define PANIC_TIMER_STEP 100
|
|
#define PANIC_BLINK_SPD 18
|
|
|
|
int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE;
|
|
static unsigned long tainted_mask =
|
|
IS_ENABLED(CONFIG_GCC_PLUGIN_RANDSTRUCT) ? (1 << TAINT_RANDSTRUCT) : 0;
|
|
static int pause_on_oops;
|
|
static int pause_on_oops_flag;
|
|
static DEFINE_SPINLOCK(pause_on_oops_lock);
|
|
bool crash_kexec_post_notifiers;
|
|
int panic_on_warn __read_mostly;
|
|
|
|
int panic_timeout = CONFIG_PANIC_TIMEOUT;
|
|
EXPORT_SYMBOL_GPL(panic_timeout);
|
|
|
|
ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
|
|
|
|
EXPORT_SYMBOL(panic_notifier_list);
|
|
|
|
static long no_blink(int state)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
/* Returns how long it waited in ms */
|
|
long (*panic_blink)(int state);
|
|
EXPORT_SYMBOL(panic_blink);
|
|
|
|
/*
|
|
* Stop ourself in panic -- architecture code may override this
|
|
*/
|
|
void __weak panic_smp_self_stop(void)
|
|
{
|
|
while (1)
|
|
cpu_relax();
|
|
}
|
|
|
|
/*
|
|
* Stop ourselves in NMI context if another CPU has already panicked. Arch code
|
|
* may override this to prepare for crash dumping, e.g. save regs info.
|
|
*/
|
|
void __weak nmi_panic_self_stop(struct pt_regs *regs)
|
|
{
|
|
panic_smp_self_stop();
|
|
}
|
|
|
|
/*
|
|
* Stop other CPUs in panic. Architecture dependent code may override this
|
|
* with more suitable version. For example, if the architecture supports
|
|
* crash dump, it should save registers of each stopped CPU and disable
|
|
* per-CPU features such as virtualization extensions.
|
|
*/
|
|
void __weak crash_smp_send_stop(void)
|
|
{
|
|
static int cpus_stopped;
|
|
|
|
/*
|
|
* This function can be called twice in panic path, but obviously
|
|
* we execute this only once.
|
|
*/
|
|
if (cpus_stopped)
|
|
return;
|
|
|
|
/*
|
|
* Note smp_send_stop is the usual smp shutdown function, which
|
|
* unfortunately means it may not be hardened to work in a panic
|
|
* situation.
|
|
*/
|
|
smp_send_stop();
|
|
cpus_stopped = 1;
|
|
}
|
|
|
|
atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
|
|
|
|
/*
|
|
* A variant of panic() called from NMI context. We return if we've already
|
|
* panicked on this CPU. If another CPU already panicked, loop in
|
|
* nmi_panic_self_stop() which can provide architecture dependent code such
|
|
* as saving register state for crash dump.
|
|
*/
|
|
void nmi_panic(struct pt_regs *regs, const char *msg)
|
|
{
|
|
int old_cpu, cpu;
|
|
|
|
cpu = raw_smp_processor_id();
|
|
old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, cpu);
|
|
|
|
if (old_cpu == PANIC_CPU_INVALID)
|
|
panic("%s", msg);
|
|
else if (old_cpu != cpu)
|
|
nmi_panic_self_stop(regs);
|
|
}
|
|
EXPORT_SYMBOL(nmi_panic);
|
|
|
|
/**
|
|
* panic - halt the system
|
|
* @fmt: The text string to print
|
|
*
|
|
* Display a message, then perform cleanups.
|
|
*
|
|
* This function never returns.
|
|
*/
|
|
void panic(const char *fmt, ...)
|
|
{
|
|
static char buf[1024];
|
|
va_list args;
|
|
long i, i_next = 0;
|
|
int state = 0;
|
|
int old_cpu, this_cpu;
|
|
bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
|
|
|
|
/*
|
|
* Disable local interrupts. This will prevent panic_smp_self_stop
|
|
* from deadlocking the first cpu that invokes the panic, since
|
|
* there is nothing to prevent an interrupt handler (that runs
|
|
* after setting panic_cpu) from invoking panic() again.
|
|
*/
|
|
local_irq_disable();
|
|
preempt_disable_notrace();
|
|
|
|
/*
|
|
* It's possible to come here directly from a panic-assertion and
|
|
* not have preempt disabled. Some functions called from here want
|
|
* preempt to be disabled. No point enabling it later though...
|
|
*
|
|
* Only one CPU is allowed to execute the panic code from here. For
|
|
* multiple parallel invocations of panic, all other CPUs either
|
|
* stop themself or will wait until they are stopped by the 1st CPU
|
|
* with smp_send_stop().
|
|
*
|
|
* `old_cpu == PANIC_CPU_INVALID' means this is the 1st CPU which
|
|
* comes here, so go ahead.
|
|
* `old_cpu == this_cpu' means we came from nmi_panic() which sets
|
|
* panic_cpu to this CPU. In this case, this is also the 1st CPU.
|
|
*/
|
|
this_cpu = raw_smp_processor_id();
|
|
old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, this_cpu);
|
|
|
|
if (old_cpu != PANIC_CPU_INVALID && old_cpu != this_cpu)
|
|
panic_smp_self_stop();
|
|
|
|
console_verbose();
|
|
bust_spinlocks(1);
|
|
va_start(args, fmt);
|
|
vsnprintf(buf, sizeof(buf), fmt, args);
|
|
va_end(args);
|
|
dump_stack_minidump(0);
|
|
pr_emerg("Kernel panic - not syncing: %s\n", buf);
|
|
#ifdef CONFIG_DEBUG_BUGVERBOSE
|
|
/*
|
|
* Avoid nested stack-dumping if a panic occurs during oops processing
|
|
*/
|
|
if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
|
|
dump_stack();
|
|
#endif
|
|
|
|
/*
|
|
* If we have crashed and we have a crash kernel loaded let it handle
|
|
* everything else.
|
|
* If we want to run this after calling panic_notifiers, pass
|
|
* the "crash_kexec_post_notifiers" option to the kernel.
|
|
*
|
|
* Bypass the panic_cpu check and call __crash_kexec directly.
|
|
*/
|
|
if (!_crash_kexec_post_notifiers) {
|
|
printk_safe_flush_on_panic();
|
|
__crash_kexec(NULL);
|
|
|
|
/*
|
|
* Note smp_send_stop is the usual smp shutdown function, which
|
|
* unfortunately means it may not be hardened to work in a
|
|
* panic situation.
|
|
*/
|
|
smp_send_stop();
|
|
} else {
|
|
/*
|
|
* If we want to do crash dump after notifier calls and
|
|
* kmsg_dump, we will need architecture dependent extra
|
|
* works in addition to stopping other CPUs.
|
|
*/
|
|
crash_smp_send_stop();
|
|
}
|
|
|
|
/*
|
|
* Run any panic handlers, including those that might need to
|
|
* add information to the kmsg dump output.
|
|
*/
|
|
atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
|
|
|
|
/* Call flush even twice. It tries harder with a single online CPU */
|
|
printk_safe_flush_on_panic();
|
|
kmsg_dump(KMSG_DUMP_PANIC);
|
|
|
|
/*
|
|
* If you doubt kdump always works fine in any situation,
|
|
* "crash_kexec_post_notifiers" offers you a chance to run
|
|
* panic_notifiers and dumping kmsg before kdump.
|
|
* Note: since some panic_notifiers can make crashed kernel
|
|
* more unstable, it can increase risks of the kdump failure too.
|
|
*
|
|
* Bypass the panic_cpu check and call __crash_kexec directly.
|
|
*/
|
|
if (_crash_kexec_post_notifiers)
|
|
__crash_kexec(NULL);
|
|
|
|
#ifdef CONFIG_VT
|
|
unblank_screen();
|
|
#endif
|
|
console_unblank();
|
|
|
|
/*
|
|
* We may have ended up stopping the CPU holding the lock (in
|
|
* smp_send_stop()) while still having some valuable data in the console
|
|
* buffer. Try to acquire the lock then release it regardless of the
|
|
* result. The release will also print the buffers out. Locks debug
|
|
* should be disabled to avoid reporting bad unlock balance when
|
|
* panic() is not being callled from OOPS.
|
|
*/
|
|
debug_locks_off();
|
|
console_flush_on_panic();
|
|
|
|
if (!panic_blink)
|
|
panic_blink = no_blink;
|
|
|
|
if (panic_timeout > 0) {
|
|
/*
|
|
* Delay timeout seconds before rebooting the machine.
|
|
* We can't use the "normal" timers since we just panicked.
|
|
*/
|
|
pr_emerg("Rebooting in %d seconds..\n", panic_timeout);
|
|
|
|
for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
|
|
touch_nmi_watchdog();
|
|
if (i >= i_next) {
|
|
i += panic_blink(state ^= 1);
|
|
i_next = i + 3600 / PANIC_BLINK_SPD;
|
|
}
|
|
mdelay(PANIC_TIMER_STEP);
|
|
}
|
|
}
|
|
if (panic_timeout != 0) {
|
|
/*
|
|
* This will not be a clean reboot, with everything
|
|
* shutting down. But if there is a chance of
|
|
* rebooting the system it will be rebooted.
|
|
*/
|
|
if (panic_reboot_mode != REBOOT_UNDEFINED)
|
|
reboot_mode = panic_reboot_mode;
|
|
emergency_restart();
|
|
}
|
|
#ifdef __sparc__
|
|
{
|
|
extern int stop_a_enabled;
|
|
/* Make sure the user can actually press Stop-A (L1-A) */
|
|
stop_a_enabled = 1;
|
|
pr_emerg("Press Stop-A (L1-A) from sun keyboard or send break\n"
|
|
"twice on console to return to the boot prom\n");
|
|
}
|
|
#endif
|
|
#if defined(CONFIG_S390)
|
|
{
|
|
unsigned long caller;
|
|
|
|
caller = (unsigned long)__builtin_return_address(0);
|
|
disabled_wait(caller);
|
|
}
|
|
#endif
|
|
pr_emerg("---[ end Kernel panic - not syncing: %s ]---\n", buf);
|
|
local_irq_enable();
|
|
for (i = 0; ; i += PANIC_TIMER_STEP) {
|
|
touch_softlockup_watchdog();
|
|
if (i >= i_next) {
|
|
i += panic_blink(state ^= 1);
|
|
i_next = i + 3600 / PANIC_BLINK_SPD;
|
|
}
|
|
mdelay(PANIC_TIMER_STEP);
|
|
}
|
|
}
|
|
|
|
EXPORT_SYMBOL(panic);
|
|
|
|
/*
|
|
* TAINT_FORCED_RMMOD could be a per-module flag but the module
|
|
* is being removed anyway.
|
|
*/
|
|
const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
|
|
[ TAINT_PROPRIETARY_MODULE ] = { 'P', 'G', true },
|
|
[ TAINT_FORCED_MODULE ] = { 'F', ' ', true },
|
|
[ TAINT_CPU_OUT_OF_SPEC ] = { 'S', ' ', false },
|
|
[ TAINT_FORCED_RMMOD ] = { 'R', ' ', false },
|
|
[ TAINT_MACHINE_CHECK ] = { 'M', ' ', false },
|
|
[ TAINT_BAD_PAGE ] = { 'B', ' ', false },
|
|
[ TAINT_USER ] = { 'U', ' ', false },
|
|
[ TAINT_DIE ] = { 'D', ' ', false },
|
|
[ TAINT_OVERRIDDEN_ACPI_TABLE ] = { 'A', ' ', false },
|
|
[ TAINT_WARN ] = { 'W', ' ', false },
|
|
[ TAINT_CRAP ] = { 'C', ' ', true },
|
|
[ TAINT_FIRMWARE_WORKAROUND ] = { 'I', ' ', false },
|
|
[ TAINT_OOT_MODULE ] = { 'O', ' ', true },
|
|
[ TAINT_UNSIGNED_MODULE ] = { 'E', ' ', true },
|
|
[ TAINT_SOFTLOCKUP ] = { 'L', ' ', false },
|
|
[ TAINT_LIVEPATCH ] = { 'K', ' ', true },
|
|
[ TAINT_AUX ] = { 'X', ' ', true },
|
|
[ TAINT_RANDSTRUCT ] = { 'T', ' ', true },
|
|
};
|
|
|
|
/**
|
|
* print_tainted - return a string to represent the kernel taint state.
|
|
*
|
|
* For individual taint flag meanings, see Documentation/sysctl/kernel.txt
|
|
*
|
|
* The string is overwritten by the next call to print_tainted(),
|
|
* but is always NULL terminated.
|
|
*/
|
|
const char *print_tainted(void)
|
|
{
|
|
static char buf[TAINT_FLAGS_COUNT + sizeof("Tainted: ")];
|
|
|
|
BUILD_BUG_ON(ARRAY_SIZE(taint_flags) != TAINT_FLAGS_COUNT);
|
|
|
|
if (tainted_mask) {
|
|
char *s;
|
|
int i;
|
|
|
|
s = buf + sprintf(buf, "Tainted: ");
|
|
for (i = 0; i < TAINT_FLAGS_COUNT; i++) {
|
|
const struct taint_flag *t = &taint_flags[i];
|
|
*s++ = test_bit(i, &tainted_mask) ?
|
|
t->c_true : t->c_false;
|
|
}
|
|
*s = 0;
|
|
} else
|
|
snprintf(buf, sizeof(buf), "Not tainted");
|
|
|
|
return buf;
|
|
}
|
|
|
|
int test_taint(unsigned flag)
|
|
{
|
|
return test_bit(flag, &tainted_mask);
|
|
}
|
|
EXPORT_SYMBOL(test_taint);
|
|
|
|
unsigned long get_taint(void)
|
|
{
|
|
return tainted_mask;
|
|
}
|
|
|
|
/**
|
|
* add_taint: add a taint flag if not already set.
|
|
* @flag: one of the TAINT_* constants.
|
|
* @lockdep_ok: whether lock debugging is still OK.
|
|
*
|
|
* If something bad has gone wrong, you'll want @lockdebug_ok = false, but for
|
|
* some notewortht-but-not-corrupting cases, it can be set to true.
|
|
*/
|
|
void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
|
|
{
|
|
if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
|
|
pr_warn("Disabling lock debugging due to kernel taint\n");
|
|
|
|
set_bit(flag, &tainted_mask);
|
|
}
|
|
EXPORT_SYMBOL(add_taint);
|
|
|
|
static void spin_msec(int msecs)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < msecs; i++) {
|
|
touch_nmi_watchdog();
|
|
mdelay(1);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* It just happens that oops_enter() and oops_exit() are identically
|
|
* implemented...
|
|
*/
|
|
static void do_oops_enter_exit(void)
|
|
{
|
|
unsigned long flags;
|
|
static int spin_counter;
|
|
|
|
if (!pause_on_oops)
|
|
return;
|
|
|
|
spin_lock_irqsave(&pause_on_oops_lock, flags);
|
|
if (pause_on_oops_flag == 0) {
|
|
/* This CPU may now print the oops message */
|
|
pause_on_oops_flag = 1;
|
|
} else {
|
|
/* We need to stall this CPU */
|
|
if (!spin_counter) {
|
|
/* This CPU gets to do the counting */
|
|
spin_counter = pause_on_oops;
|
|
do {
|
|
spin_unlock(&pause_on_oops_lock);
|
|
spin_msec(MSEC_PER_SEC);
|
|
spin_lock(&pause_on_oops_lock);
|
|
} while (--spin_counter);
|
|
pause_on_oops_flag = 0;
|
|
} else {
|
|
/* This CPU waits for a different one */
|
|
while (spin_counter) {
|
|
spin_unlock(&pause_on_oops_lock);
|
|
spin_msec(1);
|
|
spin_lock(&pause_on_oops_lock);
|
|
}
|
|
}
|
|
}
|
|
spin_unlock_irqrestore(&pause_on_oops_lock, flags);
|
|
}
|
|
|
|
/*
|
|
* Return true if the calling CPU is allowed to print oops-related info.
|
|
* This is a bit racy..
|
|
*/
|
|
int oops_may_print(void)
|
|
{
|
|
return pause_on_oops_flag == 0;
|
|
}
|
|
|
|
/*
|
|
* Called when the architecture enters its oops handler, before it prints
|
|
* anything. If this is the first CPU to oops, and it's oopsing the first
|
|
* time then let it proceed.
|
|
*
|
|
* This is all enabled by the pause_on_oops kernel boot option. We do all
|
|
* this to ensure that oopses don't scroll off the screen. It has the
|
|
* side-effect of preventing later-oopsing CPUs from mucking up the display,
|
|
* too.
|
|
*
|
|
* It turns out that the CPU which is allowed to print ends up pausing for
|
|
* the right duration, whereas all the other CPUs pause for twice as long:
|
|
* once in oops_enter(), once in oops_exit().
|
|
*/
|
|
void oops_enter(void)
|
|
{
|
|
tracing_off();
|
|
/* can't trust the integrity of the kernel anymore: */
|
|
debug_locks_off();
|
|
do_oops_enter_exit();
|
|
}
|
|
|
|
/*
|
|
* 64-bit random ID for oopses:
|
|
*/
|
|
static u64 oops_id;
|
|
|
|
static int init_oops_id(void)
|
|
{
|
|
if (!oops_id)
|
|
get_random_bytes(&oops_id, sizeof(oops_id));
|
|
else
|
|
oops_id++;
|
|
|
|
return 0;
|
|
}
|
|
late_initcall(init_oops_id);
|
|
|
|
void print_oops_end_marker(void)
|
|
{
|
|
init_oops_id();
|
|
pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id);
|
|
}
|
|
|
|
/*
|
|
* Called when the architecture exits its oops handler, after printing
|
|
* everything.
|
|
*/
|
|
void oops_exit(void)
|
|
{
|
|
do_oops_enter_exit();
|
|
print_oops_end_marker();
|
|
kmsg_dump(KMSG_DUMP_OOPS);
|
|
}
|
|
|
|
struct warn_args {
|
|
const char *fmt;
|
|
va_list args;
|
|
};
|
|
|
|
void __warn(const char *file, int line, void *caller, unsigned taint,
|
|
struct pt_regs *regs, struct warn_args *args)
|
|
{
|
|
disable_trace_on_warning();
|
|
|
|
if (args)
|
|
pr_warn(CUT_HERE);
|
|
|
|
if (file)
|
|
pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pS\n",
|
|
raw_smp_processor_id(), current->pid, file, line,
|
|
caller);
|
|
else
|
|
pr_warn("WARNING: CPU: %d PID: %d at %pS\n",
|
|
raw_smp_processor_id(), current->pid, caller);
|
|
|
|
if (args)
|
|
vprintk(args->fmt, args->args);
|
|
|
|
if (panic_on_warn) {
|
|
/*
|
|
* This thread may hit another WARN() in the panic path.
|
|
* Resetting this prevents additional WARN() from panicking the
|
|
* system on this thread. Other threads are blocked by the
|
|
* panic_mutex in panic().
|
|
*/
|
|
panic_on_warn = 0;
|
|
panic("panic_on_warn set ...\n");
|
|
}
|
|
|
|
print_modules();
|
|
|
|
if (regs)
|
|
show_regs(regs);
|
|
else
|
|
dump_stack();
|
|
|
|
print_irqtrace_events(current);
|
|
|
|
print_oops_end_marker();
|
|
|
|
/* Just a warning, don't kill lockdep. */
|
|
add_taint(taint, LOCKDEP_STILL_OK);
|
|
}
|
|
|
|
#ifdef WANT_WARN_ON_SLOWPATH
|
|
void warn_slowpath_fmt(const char *file, int line, const char *fmt, ...)
|
|
{
|
|
struct warn_args args;
|
|
|
|
args.fmt = fmt;
|
|
va_start(args.args, fmt);
|
|
__warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL,
|
|
&args);
|
|
va_end(args.args);
|
|
}
|
|
EXPORT_SYMBOL(warn_slowpath_fmt);
|
|
|
|
void warn_slowpath_fmt_taint(const char *file, int line,
|
|
unsigned taint, const char *fmt, ...)
|
|
{
|
|
struct warn_args args;
|
|
|
|
args.fmt = fmt;
|
|
va_start(args.args, fmt);
|
|
__warn(file, line, __builtin_return_address(0), taint, NULL, &args);
|
|
va_end(args.args);
|
|
}
|
|
EXPORT_SYMBOL(warn_slowpath_fmt_taint);
|
|
|
|
void warn_slowpath_null(const char *file, int line)
|
|
{
|
|
pr_warn(CUT_HERE);
|
|
__warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, NULL);
|
|
}
|
|
EXPORT_SYMBOL(warn_slowpath_null);
|
|
#else
|
|
void __warn_printk(const char *fmt, ...)
|
|
{
|
|
va_list args;
|
|
|
|
pr_warn(CUT_HERE);
|
|
|
|
va_start(args, fmt);
|
|
vprintk(fmt, args);
|
|
va_end(args);
|
|
}
|
|
EXPORT_SYMBOL(__warn_printk);
|
|
#endif
|
|
|
|
#ifdef CONFIG_BUG
|
|
|
|
/* Support resetting WARN*_ONCE state */
|
|
|
|
static int clear_warn_once_set(void *data, u64 val)
|
|
{
|
|
generic_bug_clear_once();
|
|
memset(__start_once, 0, __end_once - __start_once);
|
|
return 0;
|
|
}
|
|
|
|
DEFINE_SIMPLE_ATTRIBUTE(clear_warn_once_fops,
|
|
NULL,
|
|
clear_warn_once_set,
|
|
"%lld\n");
|
|
|
|
static __init int register_warn_debugfs(void)
|
|
{
|
|
/* Don't care about failure */
|
|
debugfs_create_file("clear_warn_once", 0200, NULL,
|
|
NULL, &clear_warn_once_fops);
|
|
return 0;
|
|
}
|
|
|
|
device_initcall(register_warn_debugfs);
|
|
#endif
|
|
|
|
#ifdef CONFIG_STACKPROTECTOR
|
|
|
|
/*
|
|
* Called when gcc's -fstack-protector feature is used, and
|
|
* gcc detects corruption of the on-stack canary value
|
|
*/
|
|
__visible void __stack_chk_fail(void)
|
|
{
|
|
panic("stack-protector: Kernel stack is corrupted in: %pB",
|
|
__builtin_return_address(0));
|
|
}
|
|
EXPORT_SYMBOL(__stack_chk_fail);
|
|
|
|
#endif
|
|
|
|
#ifdef CONFIG_ARCH_HAS_REFCOUNT
|
|
void refcount_error_report(struct pt_regs *regs, const char *err)
|
|
{
|
|
WARN_RATELIMIT(1, "refcount_t %s at %pB in %s[%d], uid/euid: %u/%u\n",
|
|
err, (void *)instruction_pointer(regs),
|
|
current->comm, task_pid_nr(current),
|
|
from_kuid_munged(&init_user_ns, current_uid()),
|
|
from_kuid_munged(&init_user_ns, current_euid()));
|
|
}
|
|
#endif
|
|
|
|
core_param(panic, panic_timeout, int, 0644);
|
|
core_param(pause_on_oops, pause_on_oops, int, 0644);
|
|
core_param(panic_on_warn, panic_on_warn, int, 0644);
|
|
core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644);
|
|
|
|
static int __init oops_setup(char *s)
|
|
{
|
|
if (!s)
|
|
return -EINVAL;
|
|
if (!strcmp(s, "panic"))
|
|
panic_on_oops = 1;
|
|
return 0;
|
|
}
|
|
early_param("oops", oops_setup);
|