dumpstack.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476
  1. /*
  2. * Copyright (C) 1991, 1992 Linus Torvalds
  3. * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
  4. */
  5. #include <linux/kallsyms.h>
  6. #include <linux/kprobes.h>
  7. #include <linux/uaccess.h>
  8. #include <linux/utsname.h>
  9. #include <linux/hardirq.h>
  10. #include <linux/kdebug.h>
  11. #include <linux/module.h>
  12. #include <linux/ptrace.h>
  13. #include <linux/sched/debug.h>
  14. #include <linux/sched/task_stack.h>
  15. #include <linux/ftrace.h>
  16. #include <linux/kexec.h>
  17. #include <linux/bug.h>
  18. #include <linux/nmi.h>
  19. #include <linux/sysfs.h>
  20. #include <linux/kasan.h>
  21. #include <asm/cpu_entry_area.h>
  22. #include <asm/stacktrace.h>
  23. #include <asm/unwind.h>
  24. int panic_on_unrecovered_nmi;
  25. int panic_on_io_nmi;
  26. static int die_counter;
  27. static struct pt_regs exec_summary_regs;
  28. bool noinstr in_task_stack(unsigned long *stack, struct task_struct *task,
  29. struct stack_info *info)
  30. {
  31. unsigned long *begin = task_stack_page(task);
  32. unsigned long *end = task_stack_page(task) + THREAD_SIZE;
  33. if (stack < begin || stack >= end)
  34. return false;
  35. info->type = STACK_TYPE_TASK;
  36. info->begin = begin;
  37. info->end = end;
  38. info->next_sp = NULL;
  39. return true;
  40. }
  41. /* Called from get_stack_info_noinstr - so must be noinstr too */
  42. bool noinstr in_entry_stack(unsigned long *stack, struct stack_info *info)
  43. {
  44. struct entry_stack *ss = cpu_entry_stack(smp_processor_id());
  45. void *begin = ss;
  46. void *end = ss + 1;
  47. if ((void *)stack < begin || (void *)stack >= end)
  48. return false;
  49. info->type = STACK_TYPE_ENTRY;
  50. info->begin = begin;
  51. info->end = end;
  52. info->next_sp = NULL;
  53. return true;
  54. }
  55. static void printk_stack_address(unsigned long address, int reliable,
  56. const char *log_lvl)
  57. {
  58. touch_nmi_watchdog();
  59. printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
  60. }
  61. static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src,
  62. unsigned int nbytes)
  63. {
  64. if (!user_mode(regs))
  65. return copy_from_kernel_nofault(buf, (u8 *)src, nbytes);
  66. /* The user space code from other tasks cannot be accessed. */
  67. if (regs != task_pt_regs(current))
  68. return -EPERM;
  69. /*
  70. * Make sure userspace isn't trying to trick us into dumping kernel
  71. * memory by pointing the userspace instruction pointer at it.
  72. */
  73. if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX))
  74. return -EINVAL;
  75. /*
  76. * Even if named copy_from_user_nmi() this can be invoked from
  77. * other contexts and will not try to resolve a pagefault, which is
  78. * the correct thing to do here as this code can be called from any
  79. * context.
  80. */
  81. return copy_from_user_nmi(buf, (void __user *)src, nbytes);
  82. }
  83. /*
  84. * There are a couple of reasons for the 2/3rd prologue, courtesy of Linus:
  85. *
  86. * In case where we don't have the exact kernel image (which, if we did, we can
  87. * simply disassemble and navigate to the RIP), the purpose of the bigger
  88. * prologue is to have more context and to be able to correlate the code from
  89. * the different toolchains better.
  90. *
  91. * In addition, it helps in recreating the register allocation of the failing
  92. * kernel and thus make sense of the register dump.
  93. *
  94. * What is more, the additional complication of a variable length insn arch like
  95. * x86 warrants having longer byte sequence before rIP so that the disassembler
  96. * can "sync" up properly and find instruction boundaries when decoding the
  97. * opcode bytes.
  98. *
  99. * Thus, the 2/3rds prologue and 64 byte OPCODE_BUFSIZE is just a random
  100. * guesstimate in attempt to achieve all of the above.
  101. */
  102. void show_opcodes(struct pt_regs *regs, const char *loglvl)
  103. {
  104. #define PROLOGUE_SIZE 42
  105. #define EPILOGUE_SIZE 21
  106. #define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE)
  107. u8 opcodes[OPCODE_BUFSIZE];
  108. unsigned long prologue = regs->ip - PROLOGUE_SIZE;
  109. switch (copy_code(regs, opcodes, prologue, sizeof(opcodes))) {
  110. case 0:
  111. printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"
  112. __stringify(EPILOGUE_SIZE) "ph\n", loglvl, opcodes,
  113. opcodes[PROLOGUE_SIZE], opcodes + PROLOGUE_SIZE + 1);
  114. break;
  115. case -EPERM:
  116. /* No access to the user space stack of other tasks. Ignore. */
  117. break;
  118. default:
  119. printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n",
  120. loglvl, prologue);
  121. break;
  122. }
  123. }
  124. void show_ip(struct pt_regs *regs, const char *loglvl)
  125. {
  126. #ifdef CONFIG_X86_32
  127. printk("%sEIP: %pS\n", loglvl, (void *)regs->ip);
  128. #else
  129. printk("%sRIP: %04x:%pS\n", loglvl, (int)regs->cs, (void *)regs->ip);
  130. #endif
  131. show_opcodes(regs, loglvl);
  132. }
  133. void show_iret_regs(struct pt_regs *regs, const char *log_lvl)
  134. {
  135. show_ip(regs, log_lvl);
  136. printk("%sRSP: %04x:%016lx EFLAGS: %08lx", log_lvl, (int)regs->ss,
  137. regs->sp, regs->flags);
  138. }
  139. static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
  140. bool partial, const char *log_lvl)
  141. {
  142. /*
  143. * These on_stack() checks aren't strictly necessary: the unwind code
  144. * has already validated the 'regs' pointer. The checks are done for
  145. * ordering reasons: if the registers are on the next stack, we don't
  146. * want to print them out yet. Otherwise they'll be shown as part of
  147. * the wrong stack. Later, when show_trace_log_lvl() switches to the
  148. * next stack, this function will be called again with the same regs so
  149. * they can be printed in the right context.
  150. */
  151. if (!partial && on_stack(info, regs, sizeof(*regs))) {
  152. __show_regs(regs, SHOW_REGS_SHORT, log_lvl);
  153. } else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
  154. IRET_FRAME_SIZE)) {
  155. /*
  156. * When an interrupt or exception occurs in entry code, the
  157. * full pt_regs might not have been saved yet. In that case
  158. * just print the iret frame.
  159. */
  160. show_iret_regs(regs, log_lvl);
  161. }
  162. }
  163. void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
  164. unsigned long *stack, const char *log_lvl)
  165. {
  166. struct unwind_state state;
  167. struct stack_info stack_info = {0};
  168. unsigned long visit_mask = 0;
  169. int graph_idx = 0;
  170. bool partial = false;
  171. printk("%sCall Trace:\n", log_lvl);
  172. unwind_start(&state, task, regs, stack);
  173. stack = stack ? : get_stack_pointer(task, regs);
  174. regs = unwind_get_entry_regs(&state, &partial);
  175. /*
  176. * Iterate through the stacks, starting with the current stack pointer.
  177. * Each stack has a pointer to the next one.
  178. *
  179. * x86-64 can have several stacks:
  180. * - task stack
  181. * - interrupt stack
  182. * - HW exception stacks (double fault, nmi, debug, mce)
  183. * - entry stack
  184. *
  185. * x86-32 can have up to four stacks:
  186. * - task stack
  187. * - softirq stack
  188. * - hardirq stack
  189. * - entry stack
  190. */
  191. for ( ; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
  192. const char *stack_name;
  193. if (get_stack_info(stack, task, &stack_info, &visit_mask)) {
  194. /*
  195. * We weren't on a valid stack. It's possible that
  196. * we overflowed a valid stack into a guard page.
  197. * See if the next page up is valid so that we can
  198. * generate some kind of backtrace if this happens.
  199. */
  200. stack = (unsigned long *)PAGE_ALIGN((unsigned long)stack);
  201. if (get_stack_info(stack, task, &stack_info, &visit_mask))
  202. break;
  203. }
  204. stack_name = stack_type_name(stack_info.type);
  205. if (stack_name)
  206. printk("%s <%s>\n", log_lvl, stack_name);
  207. if (regs)
  208. show_regs_if_on_stack(&stack_info, regs, partial, log_lvl);
  209. /*
  210. * Scan the stack, printing any text addresses we find. At the
  211. * same time, follow proper stack frames with the unwinder.
  212. *
  213. * Addresses found during the scan which are not reported by
  214. * the unwinder are considered to be additional clues which are
  215. * sometimes useful for debugging and are prefixed with '?'.
  216. * This also serves as a failsafe option in case the unwinder
  217. * goes off in the weeds.
  218. */
  219. for (; stack < stack_info.end; stack++) {
  220. unsigned long real_addr;
  221. int reliable = 0;
  222. unsigned long addr = READ_ONCE_NOCHECK(*stack);
  223. unsigned long *ret_addr_p =
  224. unwind_get_return_address_ptr(&state);
  225. if (!__kernel_text_address(addr))
  226. continue;
  227. /*
  228. * Don't print regs->ip again if it was already printed
  229. * by show_regs_if_on_stack().
  230. */
  231. if (regs && stack == &regs->ip)
  232. goto next;
  233. if (stack == ret_addr_p)
  234. reliable = 1;
  235. /*
  236. * When function graph tracing is enabled for a
  237. * function, its return address on the stack is
  238. * replaced with the address of an ftrace handler
  239. * (return_to_handler). In that case, before printing
  240. * the "real" address, we want to print the handler
  241. * address as an "unreliable" hint that function graph
  242. * tracing was involved.
  243. */
  244. real_addr = ftrace_graph_ret_addr(task, &graph_idx,
  245. addr, stack);
  246. if (real_addr != addr)
  247. printk_stack_address(addr, 0, log_lvl);
  248. printk_stack_address(real_addr, reliable, log_lvl);
  249. if (!reliable)
  250. continue;
  251. next:
  252. /*
  253. * Get the next frame from the unwinder. No need to
  254. * check for an error: if anything goes wrong, the rest
  255. * of the addresses will just be printed as unreliable.
  256. */
  257. unwind_next_frame(&state);
  258. /* if the frame has entry regs, print them */
  259. regs = unwind_get_entry_regs(&state, &partial);
  260. if (regs)
  261. show_regs_if_on_stack(&stack_info, regs, partial, log_lvl);
  262. }
  263. if (stack_name)
  264. printk("%s </%s>\n", log_lvl, stack_name);
  265. }
  266. }
  267. void show_stack(struct task_struct *task, unsigned long *sp,
  268. const char *loglvl)
  269. {
  270. task = task ? : current;
  271. /*
  272. * Stack frames below this one aren't interesting. Don't show them
  273. * if we're printing for %current.
  274. */
  275. if (!sp && task == current)
  276. sp = get_stack_pointer(current, NULL);
  277. show_trace_log_lvl(task, NULL, sp, loglvl);
  278. }
  279. void show_stack_regs(struct pt_regs *regs)
  280. {
  281. show_trace_log_lvl(current, regs, NULL, KERN_DEFAULT);
  282. }
  283. static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
  284. static int die_owner = -1;
  285. static unsigned int die_nest_count;
  286. unsigned long oops_begin(void)
  287. {
  288. int cpu;
  289. unsigned long flags;
  290. oops_enter();
  291. /* racy, but better than risking deadlock. */
  292. raw_local_irq_save(flags);
  293. cpu = smp_processor_id();
  294. if (!arch_spin_trylock(&die_lock)) {
  295. if (cpu == die_owner)
  296. /* nested oops. should stop eventually */;
  297. else
  298. arch_spin_lock(&die_lock);
  299. }
  300. die_nest_count++;
  301. die_owner = cpu;
  302. console_verbose();
  303. bust_spinlocks(1);
  304. return flags;
  305. }
  306. NOKPROBE_SYMBOL(oops_begin);
  307. void __noreturn rewind_stack_do_exit(int signr);
  308. void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
  309. {
  310. if (regs && kexec_should_crash(current))
  311. crash_kexec(regs);
  312. bust_spinlocks(0);
  313. die_owner = -1;
  314. add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
  315. die_nest_count--;
  316. if (!die_nest_count)
  317. /* Nest count reaches zero, release the lock. */
  318. arch_spin_unlock(&die_lock);
  319. raw_local_irq_restore(flags);
  320. oops_exit();
  321. /* Executive summary in case the oops scrolled away */
  322. __show_regs(&exec_summary_regs, SHOW_REGS_ALL, KERN_DEFAULT);
  323. if (!signr)
  324. return;
  325. if (in_interrupt())
  326. panic("Fatal exception in interrupt");
  327. if (panic_on_oops)
  328. panic("Fatal exception");
  329. /*
  330. * We're not going to return, but we might be on an IST stack or
  331. * have very little stack space left. Rewind the stack and kill
  332. * the task.
  333. * Before we rewind the stack, we have to tell KASAN that we're going to
  334. * reuse the task stack and that existing poisons are invalid.
  335. */
  336. kasan_unpoison_task_stack(current);
  337. rewind_stack_do_exit(signr);
  338. }
  339. NOKPROBE_SYMBOL(oops_end);
  340. static void __die_header(const char *str, struct pt_regs *regs, long err)
  341. {
  342. const char *pr = "";
  343. /* Save the regs of the first oops for the executive summary later. */
  344. if (!die_counter)
  345. exec_summary_regs = *regs;
  346. if (IS_ENABLED(CONFIG_PREEMPTION))
  347. pr = IS_ENABLED(CONFIG_PREEMPT_RT) ? " PREEMPT_RT" : " PREEMPT";
  348. printk(KERN_DEFAULT
  349. "%s: %04lx [#%d]%s%s%s%s%s\n", str, err & 0xffff, ++die_counter,
  350. pr,
  351. IS_ENABLED(CONFIG_SMP) ? " SMP" : "",
  352. debug_pagealloc_enabled() ? " DEBUG_PAGEALLOC" : "",
  353. IS_ENABLED(CONFIG_KASAN) ? " KASAN" : "",
  354. IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION) ?
  355. (boot_cpu_has(X86_FEATURE_PTI) ? " PTI" : " NOPTI") : "");
  356. }
  357. NOKPROBE_SYMBOL(__die_header);
  358. static int __die_body(const char *str, struct pt_regs *regs, long err)
  359. {
  360. show_regs(regs);
  361. print_modules();
  362. if (notify_die(DIE_OOPS, str, regs, err,
  363. current->thread.trap_nr, SIGSEGV) == NOTIFY_STOP)
  364. return 1;
  365. return 0;
  366. }
  367. NOKPROBE_SYMBOL(__die_body);
  368. int __die(const char *str, struct pt_regs *regs, long err)
  369. {
  370. __die_header(str, regs, err);
  371. return __die_body(str, regs, err);
  372. }
  373. NOKPROBE_SYMBOL(__die);
  374. /*
  375. * This is gone through when something in the kernel has done something bad
  376. * and is about to be terminated:
  377. */
  378. void die(const char *str, struct pt_regs *regs, long err)
  379. {
  380. unsigned long flags = oops_begin();
  381. int sig = SIGSEGV;
  382. if (__die(str, regs, err))
  383. sig = 0;
  384. oops_end(flags, regs, sig);
  385. }
  386. void die_addr(const char *str, struct pt_regs *regs, long err, long gp_addr)
  387. {
  388. unsigned long flags = oops_begin();
  389. int sig = SIGSEGV;
  390. __die_header(str, regs, err);
  391. if (gp_addr)
  392. kasan_non_canonical_hook(gp_addr);
  393. if (__die_body(str, regs, err))
  394. sig = 0;
  395. oops_end(flags, regs, sig);
  396. }
  397. void show_regs(struct pt_regs *regs)
  398. {
  399. enum show_regs_mode print_kernel_regs;
  400. show_regs_print_info(KERN_DEFAULT);
  401. print_kernel_regs = user_mode(regs) ? SHOW_REGS_USER : SHOW_REGS_ALL;
  402. __show_regs(regs, print_kernel_regs, KERN_DEFAULT);
  403. /*
  404. * When in-kernel, we also print out the stack at the time of the fault..
  405. */
  406. if (!user_mode(regs))
  407. show_trace_log_lvl(current, regs, NULL, KERN_DEFAULT);
  408. }