FilesExpand file tree

 master

/

fail_function.c

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

349 lines (295 loc) · 6.97 KB

 master

/

fail_function.c

Copy path

Top

File metadata and controls

• Code
• Blame

349 lines (295 loc) · 6.97 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

// SPDX-License-Identifier: GPL-2.0

/*

* fail_function.c: Function-based error injection

*/

#include <linux/error-injection.h>

#include <linux/debugfs.h>

#include <linux/fault-inject.h>

#include <linux/kallsyms.h>

#include <linux/kprobes.h>

#include <linux/module.h>

#include <linux/mutex.h>

#include <linux/slab.h>

#include <linux/uaccess.h>

static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs);

struct fei_attr {

struct list_head list;

struct kprobe kp;

unsigned long retval;

};

static DEFINE_MUTEX(fei_lock);

static LIST_HEAD(fei_attr_list);

static DECLARE_FAULT_ATTR(fei_fault_attr);

static struct dentry *fei_debugfs_dir;

static unsigned long adjust_error_retval(unsigned long addr, unsigned long retv)

{

switch (get_injectable_error_type(addr)) {

case EI_ETYPE_NULL:

if (retv != 0)

return 0;

break;

case EI_ETYPE_ERRNO:

if (retv < (unsigned long)-MAX_ERRNO)

return (unsigned long)-EINVAL;

break;

case EI_ETYPE_ERRNO_NULL:

if (retv != 0 && retv < (unsigned long)-MAX_ERRNO)

return (unsigned long)-EINVAL;

break;

}

return retv;

}

static struct fei_attr *fei_attr_new(const char *sym, unsigned long addr)

{

struct fei_attr *attr;

attr = kzalloc(sizeof(*attr), GFP_KERNEL);

if (attr) {

attr->kp.symbol_name = kstrdup(sym, GFP_KERNEL);

if (!attr->kp.symbol_name) {

kfree(attr);

return NULL;

}

attr->kp.pre_handler = fei_kprobe_handler;

attr->retval = adjust_error_retval(addr, 0);

INIT_LIST_HEAD(&attr->list);

}

return attr;

}

static void fei_attr_free(struct fei_attr *attr)

{

if (attr) {

kfree(attr->kp.symbol_name);

kfree(attr);

}

}

static struct fei_attr *fei_attr_lookup(const char *sym)

{

struct fei_attr *attr;

list_for_each_entry(attr, &fei_attr_list, list) {

if (!strcmp(attr->kp.symbol_name, sym))

return attr;

}

return NULL;

}

static bool fei_attr_is_valid(struct fei_attr *_attr)

{

struct fei_attr *attr;

list_for_each_entry(attr, &fei_attr_list, list) {

if (attr == _attr)

return true;

}

return false;

}

static int fei_retval_set(void *data, u64 val)

{

struct fei_attr *attr = data;

unsigned long retv = (unsigned long)val;

int err = 0;

mutex_lock(&fei_lock);

/*

* Since this operation can be done after retval file is removed,

* It is safer to check the attr is still valid before accessing

* its member.

*/

if (!fei_attr_is_valid(attr)) {

err = -ENOENT;

goto out;

}

if (attr->kp.addr) {

if (adjust_error_retval((unsigned long)attr->kp.addr,

val) != retv)

err = -EINVAL;

}

if (!err)

attr->retval = val;

out:

mutex_unlock(&fei_lock);

return err;

}

static int fei_retval_get(void *data, u64 *val)

{

struct fei_attr *attr = data;

int err = 0;

mutex_lock(&fei_lock);

/* Here we also validate @attr to ensure it still exists. */

if (!fei_attr_is_valid(attr))

err = -ENOENT;

else

*val = attr->retval;

mutex_unlock(&fei_lock);

return err;

}

DEFINE_DEBUGFS_ATTRIBUTE(fei_retval_ops, fei_retval_get, fei_retval_set,

"%llx\n");

static int fei_debugfs_add_attr(struct fei_attr *attr)

{

struct dentry *dir;

dir = debugfs_create_dir(attr->kp.symbol_name, fei_debugfs_dir);

if (!dir)

return -ENOMEM;

if (!debugfs_create_file("retval", 0600, dir, attr, &fei_retval_ops)) {

debugfs_remove_recursive(dir);

return -ENOMEM;

}

return 0;

}

static void fei_debugfs_remove_attr(struct fei_attr *attr)

{

struct dentry *dir;

dir = debugfs_lookup(attr->kp.symbol_name, fei_debugfs_dir);

if (dir)

debugfs_remove_recursive(dir);

}

static int fei_kprobe_handler(struct kprobe *kp, struct pt_regs *regs)

{

struct fei_attr *attr = container_of(kp, struct fei_attr, kp);

if (should_fail(&fei_fault_attr, 1)) {

regs_set_return_value(regs, attr->retval);

override_function_with_return(regs);

/* Kprobe specific fixup */

reset_current_kprobe();

preempt_enable_no_resched();

return 1;

}

return 0;

}

NOKPROBE_SYMBOL(fei_kprobe_handler)

static void *fei_seq_start(struct seq_file *m, loff_t *pos)

{

mutex_lock(&fei_lock);

return seq_list_start(&fei_attr_list, *pos);

}

static void fei_seq_stop(struct seq_file *m, void *v)

{

mutex_unlock(&fei_lock);

}

static void *fei_seq_next(struct seq_file *m, void *v, loff_t *pos)

{

return seq_list_next(v, &fei_attr_list, pos);

}

static int fei_seq_show(struct seq_file *m, void *v)

{

struct fei_attr *attr = list_entry(v, struct fei_attr, list);

seq_printf(m, "%pf\n", attr->kp.addr);

return 0;

}

static const struct seq_operations fei_seq_ops = {

.start = fei_seq_start,

.next = fei_seq_next,

.stop = fei_seq_stop,

.show = fei_seq_show,

};

static int fei_open(struct inode *inode, struct file *file)

{

return seq_open(file, &fei_seq_ops);

}

static void fei_attr_remove(struct fei_attr *attr)

{

fei_debugfs_remove_attr(attr);

unregister_kprobe(&attr->kp);

list_del(&attr->list);

fei_attr_free(attr);

}

static void fei_attr_remove_all(void)

{

struct fei_attr *attr, *n;

list_for_each_entry_safe(attr, n, &fei_attr_list, list) {

fei_attr_remove(attr);

}

}

static ssize_t fei_write(struct file *file, const char __user *buffer,

size_t count, loff_t *ppos)

{

struct fei_attr *attr;

unsigned long addr;

char *buf, *sym;

int ret;

/* cut off if it is too long */

if (count > KSYM_NAME_LEN)

count = KSYM_NAME_LEN;

buf = kmalloc(sizeof(char) * (count + 1), GFP_KERNEL);

if (!buf)

return -ENOMEM;

if (copy_from_user(buf, buffer, count)) {

ret = -EFAULT;

goto out;

}

buf[count] = '\0';

sym = strstrip(buf);

mutex_lock(&fei_lock);

/* Writing just spaces will remove all injection points */

if (sym[0] == '\0') {

fei_attr_remove_all();

ret = count;

goto out;

}

/* Writing !function will remove one injection point */

if (sym[0] == '!') {

attr = fei_attr_lookup(sym + 1);

if (!attr) {

ret = -ENOENT;

goto out;

}

fei_attr_remove(attr);

ret = count;

goto out;

}

addr = kallsyms_lookup_name(sym);

if (!addr) {

ret = -EINVAL;

goto out;

}

if (!within_error_injection_list(addr)) {

ret = -ERANGE;

goto out;

}

if (fei_attr_lookup(sym)) {

ret = -EBUSY;

goto out;

}

attr = fei_attr_new(sym, addr);

if (!attr) {

ret = -ENOMEM;

goto out;

}

ret = register_kprobe(&attr->kp);

if (!ret)

ret = fei_debugfs_add_attr(attr);

if (ret < 0)

fei_attr_remove(attr);

else {

list_add_tail(&attr->list, &fei_attr_list);

ret = count;

}

out:

kfree(buf);

mutex_unlock(&fei_lock);

return ret;

}

static const struct file_operations fei_ops = {

.open = fei_open,

.read = seq_read,

.write = fei_write,

.llseek = seq_lseek,

.release = seq_release,

};

static int __init fei_debugfs_init(void)

{

struct dentry *dir;

dir = fault_create_debugfs_attr("fail_function", NULL,

&fei_fault_attr);

if (IS_ERR(dir))

return PTR_ERR(dir);

/* injectable attribute is just a symlink of error_inject/list */

if (!debugfs_create_symlink("injectable", dir,

"../error_injection/list"))

goto error;

if (!debugfs_create_file("inject", 0600, dir, NULL, &fei_ops))

goto error;

fei_debugfs_dir = dir;

return 0;

error:

debugfs_remove_recursive(dir);

return -ENOMEM;

}

late_initcall(fei_debugfs_init);