Commit | Line | Data |
---|---|---|
8bb31b9d | 1 | /* |
426f3a53 KC |
2 | * Linux Kernel Dump Test Module for testing kernel crashes conditions: |
3 | * induces system failures at predefined crashpoints and under predefined | |
4 | * operational conditions in order to evaluate the reliability of kernel | |
5 | * sanity checking and crash dumps obtained using different dumping | |
6 | * solutions. | |
8bb31b9d AG |
7 | * |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | |
21 | * | |
22 | * Copyright (C) IBM Corporation, 2006 | |
23 | * | |
24 | * Author: Ankita Garg <ankita@in.ibm.com> | |
25 | * | |
8bb31b9d AG |
26 | * It is adapted from the Linux Kernel Dump Test Tool by |
27 | * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net> | |
28 | * | |
0347af4e | 29 | * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net> |
8bb31b9d | 30 | * |
0347af4e | 31 | * See Documentation/fault-injection/provoke-crashes.txt for instructions |
8bb31b9d | 32 | */ |
426f3a53 | 33 | #define pr_fmt(fmt) "lkdtm: " fmt |
8bb31b9d AG |
34 | |
35 | #include <linux/kernel.h> | |
5d861d92 | 36 | #include <linux/fs.h> |
8bb31b9d | 37 | #include <linux/module.h> |
5d861d92 | 38 | #include <linux/buffer_head.h> |
8bb31b9d | 39 | #include <linux/kprobes.h> |
5d861d92 | 40 | #include <linux/list.h> |
8bb31b9d | 41 | #include <linux/init.h> |
8bb31b9d | 42 | #include <linux/interrupt.h> |
5d861d92 | 43 | #include <linux/hrtimer.h> |
5a0e3ad6 | 44 | #include <linux/slab.h> |
8bb31b9d | 45 | #include <scsi/scsi_cmnd.h> |
0347af4e | 46 | #include <linux/debugfs.h> |
cc33c537 | 47 | #include <linux/vmalloc.h> |
9ae113ce | 48 | #include <linux/mman.h> |
1bc9fac3 | 49 | #include <asm/cacheflush.h> |
8bb31b9d AG |
50 | |
51 | #ifdef CONFIG_IDE | |
52 | #include <linux/ide.h> | |
53 | #endif | |
54 | ||
9a49a528 KC |
55 | #include "lkdtm.h" |
56 | ||
7d196ac3 KC |
57 | /* |
58 | * Make sure our attempts to over run the kernel stack doesn't trigger | |
59 | * a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we | |
60 | * recurse past the end of THREAD_SIZE by default. | |
61 | */ | |
62 | #if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0) | |
63 | #define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2) | |
64 | #else | |
65 | #define REC_STACK_SIZE (THREAD_SIZE / 8) | |
66 | #endif | |
67 | #define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2) | |
68 | ||
8bb31b9d | 69 | #define DEFAULT_COUNT 10 |
cc33c537 | 70 | #define EXEC_SIZE 64 |
8bb31b9d AG |
71 | |
72 | enum cname { | |
93e2f585 NK |
73 | CN_INVALID, |
74 | CN_INT_HARDWARE_ENTRY, | |
75 | CN_INT_HW_IRQ_EN, | |
76 | CN_INT_TASKLET_ENTRY, | |
77 | CN_FS_DEVRW, | |
78 | CN_MEM_SWAPOUT, | |
79 | CN_TIMERADD, | |
80 | CN_SCSI_DISPATCH_CMD, | |
81 | CN_IDE_CORE_CP, | |
82 | CN_DIRECT, | |
8bb31b9d AG |
83 | }; |
84 | ||
85 | enum ctype { | |
93e2f585 NK |
86 | CT_NONE, |
87 | CT_PANIC, | |
88 | CT_BUG, | |
65892723 | 89 | CT_WARNING, |
93e2f585 NK |
90 | CT_EXCEPTION, |
91 | CT_LOOP, | |
92 | CT_OVERFLOW, | |
93 | CT_CORRUPT_STACK, | |
94 | CT_UNALIGNED_LOAD_STORE_WRITE, | |
95 | CT_OVERWRITE_ALLOCATION, | |
96 | CT_WRITE_AFTER_FREE, | |
bc0b8cc6 | 97 | CT_READ_AFTER_FREE, |
920d451f LA |
98 | CT_WRITE_BUDDY_AFTER_FREE, |
99 | CT_READ_BUDDY_AFTER_FREE, | |
93e2f585 NK |
100 | CT_SOFTLOCKUP, |
101 | CT_HARDLOCKUP, | |
274a5855 | 102 | CT_SPINLOCKUP, |
93e2f585 | 103 | CT_HUNG_TASK, |
cc33c537 KC |
104 | CT_EXEC_DATA, |
105 | CT_EXEC_STACK, | |
106 | CT_EXEC_KMALLOC, | |
107 | CT_EXEC_VMALLOC, | |
9a49a528 | 108 | CT_EXEC_RODATA, |
9ae113ce KC |
109 | CT_EXEC_USERSPACE, |
110 | CT_ACCESS_USERSPACE, | |
111 | CT_WRITE_RO, | |
7cca071c | 112 | CT_WRITE_RO_AFTER_INIT, |
dc2b9e90 | 113 | CT_WRITE_KERN, |
5fd9e480 | 114 | CT_WRAP_ATOMIC |
8bb31b9d AG |
115 | }; |
116 | ||
117 | static char* cp_name[] = { | |
118 | "INT_HARDWARE_ENTRY", | |
119 | "INT_HW_IRQ_EN", | |
120 | "INT_TASKLET_ENTRY", | |
121 | "FS_DEVRW", | |
122 | "MEM_SWAPOUT", | |
123 | "TIMERADD", | |
124 | "SCSI_DISPATCH_CMD", | |
0347af4e SK |
125 | "IDE_CORE_CP", |
126 | "DIRECT", | |
8bb31b9d AG |
127 | }; |
128 | ||
129 | static char* cp_type[] = { | |
130 | "PANIC", | |
131 | "BUG", | |
65892723 | 132 | "WARNING", |
8bb31b9d AG |
133 | "EXCEPTION", |
134 | "LOOP", | |
0347af4e SK |
135 | "OVERFLOW", |
136 | "CORRUPT_STACK", | |
137 | "UNALIGNED_LOAD_STORE_WRITE", | |
138 | "OVERWRITE_ALLOCATION", | |
139 | "WRITE_AFTER_FREE", | |
bc0b8cc6 | 140 | "READ_AFTER_FREE", |
920d451f LA |
141 | "WRITE_BUDDY_AFTER_FREE", |
142 | "READ_BUDDY_AFTER_FREE", | |
a48223f9 FW |
143 | "SOFTLOCKUP", |
144 | "HARDLOCKUP", | |
274a5855 | 145 | "SPINLOCKUP", |
a48223f9 | 146 | "HUNG_TASK", |
cc33c537 KC |
147 | "EXEC_DATA", |
148 | "EXEC_STACK", | |
149 | "EXEC_KMALLOC", | |
150 | "EXEC_VMALLOC", | |
9a49a528 | 151 | "EXEC_RODATA", |
9ae113ce KC |
152 | "EXEC_USERSPACE", |
153 | "ACCESS_USERSPACE", | |
154 | "WRITE_RO", | |
7cca071c | 155 | "WRITE_RO_AFTER_INIT", |
dc2b9e90 | 156 | "WRITE_KERN", |
5fd9e480 | 157 | "WRAP_ATOMIC" |
8bb31b9d AG |
158 | }; |
159 | ||
160 | static struct jprobe lkdtm; | |
161 | ||
162 | static int lkdtm_parse_commandline(void); | |
163 | static void lkdtm_handler(void); | |
164 | ||
ec1c620b AV |
165 | static char* cpoint_name; |
166 | static char* cpoint_type; | |
8bb31b9d AG |
167 | static int cpoint_count = DEFAULT_COUNT; |
168 | static int recur_count = REC_NUM_DEFAULT; | |
169 | ||
93e2f585 NK |
170 | static enum cname cpoint = CN_INVALID; |
171 | static enum ctype cptype = CT_NONE; | |
8bb31b9d | 172 | static int count = DEFAULT_COUNT; |
aa2c96d6 | 173 | static DEFINE_SPINLOCK(count_lock); |
274a5855 | 174 | static DEFINE_SPINLOCK(lock_me_up); |
8bb31b9d | 175 | |
cc33c537 KC |
176 | static u8 data_area[EXEC_SIZE]; |
177 | ||
9ae113ce | 178 | static const unsigned long rodata = 0xAA55AA55; |
7cca071c | 179 | static unsigned long ro_after_init __ro_after_init = 0x55AA5500; |
9ae113ce | 180 | |
8bb31b9d | 181 | module_param(recur_count, int, 0644); |
7d196ac3 | 182 | MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test"); |
dca41306 | 183 | module_param(cpoint_name, charp, 0444); |
5d861d92 | 184 | MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed"); |
dca41306 | 185 | module_param(cpoint_type, charp, 0444); |
5d861d92 RD |
186 | MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\ |
187 | "hitting the crash point"); | |
188 | module_param(cpoint_count, int, 0644); | |
189 | MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\ | |
190 | "crash point is to be hit to trigger action"); | |
8bb31b9d | 191 | |
2118116e | 192 | static unsigned int jp_do_irq(unsigned int irq) |
8bb31b9d AG |
193 | { |
194 | lkdtm_handler(); | |
195 | jprobe_return(); | |
196 | return 0; | |
197 | } | |
198 | ||
2118116e AB |
199 | static irqreturn_t jp_handle_irq_event(unsigned int irq, |
200 | struct irqaction *action) | |
8bb31b9d AG |
201 | { |
202 | lkdtm_handler(); | |
203 | jprobe_return(); | |
204 | return 0; | |
205 | } | |
206 | ||
2118116e | 207 | static void jp_tasklet_action(struct softirq_action *a) |
8bb31b9d AG |
208 | { |
209 | lkdtm_handler(); | |
210 | jprobe_return(); | |
211 | } | |
212 | ||
2118116e | 213 | static void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[]) |
8bb31b9d AG |
214 | { |
215 | lkdtm_handler(); | |
216 | jprobe_return(); | |
217 | } | |
218 | ||
219 | struct scan_control; | |
220 | ||
2118116e AB |
221 | static unsigned long jp_shrink_inactive_list(unsigned long max_scan, |
222 | struct zone *zone, | |
223 | struct scan_control *sc) | |
8bb31b9d AG |
224 | { |
225 | lkdtm_handler(); | |
226 | jprobe_return(); | |
227 | return 0; | |
228 | } | |
229 | ||
2118116e AB |
230 | static int jp_hrtimer_start(struct hrtimer *timer, ktime_t tim, |
231 | const enum hrtimer_mode mode) | |
8bb31b9d AG |
232 | { |
233 | lkdtm_handler(); | |
234 | jprobe_return(); | |
235 | return 0; | |
236 | } | |
237 | ||
2118116e | 238 | static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd) |
8bb31b9d AG |
239 | { |
240 | lkdtm_handler(); | |
241 | jprobe_return(); | |
242 | return 0; | |
243 | } | |
244 | ||
245 | #ifdef CONFIG_IDE | |
44629432 | 246 | static int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file, |
8bb31b9d AG |
247 | struct block_device *bdev, unsigned int cmd, |
248 | unsigned long arg) | |
249 | { | |
250 | lkdtm_handler(); | |
251 | jprobe_return(); | |
252 | return 0; | |
253 | } | |
254 | #endif | |
255 | ||
0347af4e SK |
256 | /* Return the crashpoint number or NONE if the name is invalid */ |
257 | static enum ctype parse_cp_type(const char *what, size_t count) | |
258 | { | |
259 | int i; | |
260 | ||
261 | for (i = 0; i < ARRAY_SIZE(cp_type); i++) { | |
262 | if (!strcmp(what, cp_type[i])) | |
263 | return i + 1; | |
264 | } | |
265 | ||
93e2f585 | 266 | return CT_NONE; |
0347af4e SK |
267 | } |
268 | ||
269 | static const char *cp_type_to_str(enum ctype type) | |
270 | { | |
93e2f585 | 271 | if (type == CT_NONE || type < 0 || type > ARRAY_SIZE(cp_type)) |
0347af4e SK |
272 | return "None"; |
273 | ||
274 | return cp_type[type - 1]; | |
275 | } | |
276 | ||
277 | static const char *cp_name_to_str(enum cname name) | |
278 | { | |
93e2f585 | 279 | if (name == CN_INVALID || name < 0 || name > ARRAY_SIZE(cp_name)) |
0347af4e SK |
280 | return "INVALID"; |
281 | ||
282 | return cp_name[name - 1]; | |
283 | } | |
284 | ||
285 | ||
8bb31b9d AG |
286 | static int lkdtm_parse_commandline(void) |
287 | { | |
288 | int i; | |
aa2c96d6 | 289 | unsigned long flags; |
8bb31b9d | 290 | |
0347af4e | 291 | if (cpoint_count < 1 || recur_count < 1) |
8bb31b9d AG |
292 | return -EINVAL; |
293 | ||
aa2c96d6 | 294 | spin_lock_irqsave(&count_lock, flags); |
0347af4e | 295 | count = cpoint_count; |
aa2c96d6 | 296 | spin_unlock_irqrestore(&count_lock, flags); |
0347af4e SK |
297 | |
298 | /* No special parameters */ | |
299 | if (!cpoint_type && !cpoint_name) | |
300 | return 0; | |
301 | ||
302 | /* Neither or both of these need to be set */ | |
303 | if (!cpoint_type || !cpoint_name) | |
304 | return -EINVAL; | |
305 | ||
306 | cptype = parse_cp_type(cpoint_type, strlen(cpoint_type)); | |
93e2f585 | 307 | if (cptype == CT_NONE) |
0347af4e SK |
308 | return -EINVAL; |
309 | ||
310 | for (i = 0; i < ARRAY_SIZE(cp_name); i++) { | |
8bb31b9d AG |
311 | if (!strcmp(cpoint_name, cp_name[i])) { |
312 | cpoint = i + 1; | |
0347af4e | 313 | return 0; |
8bb31b9d AG |
314 | } |
315 | } | |
316 | ||
0347af4e SK |
317 | /* Could not find a valid crash point */ |
318 | return -EINVAL; | |
8bb31b9d AG |
319 | } |
320 | ||
7d196ac3 | 321 | static int recursive_loop(int remaining) |
8bb31b9d | 322 | { |
7d196ac3 | 323 | char buf[REC_STACK_SIZE]; |
8bb31b9d | 324 | |
7d196ac3 KC |
325 | /* Make sure compiler does not optimize this away. */ |
326 | memset(buf, (remaining & 0xff) | 0x1, REC_STACK_SIZE); | |
327 | if (!remaining) | |
8bb31b9d AG |
328 | return 0; |
329 | else | |
7d196ac3 | 330 | return recursive_loop(remaining - 1); |
8bb31b9d AG |
331 | } |
332 | ||
cc33c537 KC |
333 | static void do_nothing(void) |
334 | { | |
335 | return; | |
336 | } | |
337 | ||
dc2b9e90 KC |
338 | /* Must immediately follow do_nothing for size calculuations to work out. */ |
339 | static void do_overwritten(void) | |
340 | { | |
341 | pr_info("do_overwritten wasn't overwritten!\n"); | |
342 | return; | |
343 | } | |
344 | ||
629c66a2 KC |
345 | static noinline void corrupt_stack(void) |
346 | { | |
347 | /* Use default char array length that triggers stack protection. */ | |
348 | char data[8]; | |
349 | ||
350 | memset((void *)data, 0, 64); | |
351 | } | |
352 | ||
9a49a528 | 353 | static noinline void execute_location(void *dst, bool write) |
cc33c537 KC |
354 | { |
355 | void (*func)(void) = dst; | |
356 | ||
aac416fc KC |
357 | pr_info("attempting ok execution at %p\n", do_nothing); |
358 | do_nothing(); | |
359 | ||
9a49a528 KC |
360 | if (write) { |
361 | memcpy(dst, do_nothing, EXEC_SIZE); | |
362 | flush_icache_range((unsigned long)dst, | |
363 | (unsigned long)dst + EXEC_SIZE); | |
364 | } | |
aac416fc | 365 | pr_info("attempting bad execution at %p\n", func); |
cc33c537 KC |
366 | func(); |
367 | } | |
368 | ||
9ae113ce KC |
369 | static void execute_user_location(void *dst) |
370 | { | |
5123662a | 371 | /* Intentionally crossing kernel/user memory boundary. */ |
9ae113ce KC |
372 | void (*func)(void) = dst; |
373 | ||
aac416fc KC |
374 | pr_info("attempting ok execution at %p\n", do_nothing); |
375 | do_nothing(); | |
376 | ||
5123662a | 377 | if (copy_to_user((void __user *)dst, do_nothing, EXEC_SIZE)) |
9ae113ce | 378 | return; |
aac416fc KC |
379 | flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE); |
380 | pr_info("attempting bad execution at %p\n", func); | |
9ae113ce KC |
381 | func(); |
382 | } | |
383 | ||
0347af4e | 384 | static void lkdtm_do_action(enum ctype which) |
8bb31b9d | 385 | { |
0347af4e | 386 | switch (which) { |
93e2f585 | 387 | case CT_PANIC: |
0347af4e SK |
388 | panic("dumptest"); |
389 | break; | |
93e2f585 | 390 | case CT_BUG: |
0347af4e SK |
391 | BUG(); |
392 | break; | |
65892723 KC |
393 | case CT_WARNING: |
394 | WARN_ON(1); | |
395 | break; | |
93e2f585 | 396 | case CT_EXCEPTION: |
0347af4e SK |
397 | *((int *) 0) = 0; |
398 | break; | |
93e2f585 | 399 | case CT_LOOP: |
0347af4e SK |
400 | for (;;) |
401 | ; | |
402 | break; | |
93e2f585 | 403 | case CT_OVERFLOW: |
7d196ac3 | 404 | (void) recursive_loop(recur_count); |
0347af4e | 405 | break; |
629c66a2 KC |
406 | case CT_CORRUPT_STACK: |
407 | corrupt_stack(); | |
0347af4e | 408 | break; |
93e2f585 | 409 | case CT_UNALIGNED_LOAD_STORE_WRITE: { |
0347af4e SK |
410 | static u8 data[5] __attribute__((aligned(4))) = {1, 2, |
411 | 3, 4, 5}; | |
412 | u32 *p; | |
413 | u32 val = 0x12345678; | |
414 | ||
415 | p = (u32 *)(data + 1); | |
416 | if (*p == 0) | |
417 | val = 0x87654321; | |
418 | *p = val; | |
419 | break; | |
420 | } | |
93e2f585 | 421 | case CT_OVERWRITE_ALLOCATION: { |
0347af4e SK |
422 | size_t len = 1020; |
423 | u32 *data = kmalloc(len, GFP_KERNEL); | |
424 | ||
425 | data[1024 / sizeof(u32)] = 0x12345678; | |
426 | kfree(data); | |
427 | break; | |
428 | } | |
93e2f585 | 429 | case CT_WRITE_AFTER_FREE: { |
7c0ae5be | 430 | int *base, *again; |
0347af4e | 431 | size_t len = 1024; |
250a8988 LA |
432 | /* |
433 | * The slub allocator uses the first word to store the free | |
434 | * pointer in some configurations. Use the middle of the | |
435 | * allocation to avoid running into the freelist | |
436 | */ | |
437 | size_t offset = (len / sizeof(*base)) / 2; | |
0347af4e | 438 | |
250a8988 LA |
439 | base = kmalloc(len, GFP_KERNEL); |
440 | pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]); | |
250a8988 LA |
441 | pr_info("Attempting bad write to freed memory at %p\n", |
442 | &base[offset]); | |
7c0ae5be | 443 | kfree(base); |
250a8988 | 444 | base[offset] = 0x0abcdef0; |
7c0ae5be KC |
445 | /* Attempt to notice the overwrite. */ |
446 | again = kmalloc(len, GFP_KERNEL); | |
447 | kfree(again); | |
448 | if (again != base) | |
449 | pr_info("Hmm, didn't get the same memory range.\n"); | |
0347af4e | 450 | |
0347af4e SK |
451 | break; |
452 | } | |
bc0b8cc6 LA |
453 | case CT_READ_AFTER_FREE: { |
454 | int *base, *val, saw; | |
455 | size_t len = 1024; | |
456 | /* | |
457 | * The slub allocator uses the first word to store the free | |
458 | * pointer in some configurations. Use the middle of the | |
459 | * allocation to avoid running into the freelist | |
460 | */ | |
461 | size_t offset = (len / sizeof(*base)) / 2; | |
462 | ||
463 | base = kmalloc(len, GFP_KERNEL); | |
464 | if (!base) | |
465 | break; | |
466 | ||
467 | val = kmalloc(len, GFP_KERNEL); | |
d2e10088 SM |
468 | if (!val) { |
469 | kfree(base); | |
bc0b8cc6 | 470 | break; |
d2e10088 | 471 | } |
bc0b8cc6 LA |
472 | |
473 | *val = 0x12345678; | |
474 | base[offset] = *val; | |
475 | pr_info("Value in memory before free: %x\n", base[offset]); | |
476 | ||
477 | kfree(base); | |
478 | ||
479 | pr_info("Attempting bad read from freed memory\n"); | |
480 | saw = base[offset]; | |
481 | if (saw != *val) { | |
482 | /* Good! Poisoning happened, so declare a win. */ | |
7c0ae5be | 483 | pr_info("Memory correctly poisoned (%x)\n", saw); |
bc0b8cc6 LA |
484 | BUG(); |
485 | } | |
486 | pr_info("Memory was not poisoned\n"); | |
487 | ||
488 | kfree(val); | |
489 | break; | |
490 | } | |
920d451f LA |
491 | case CT_WRITE_BUDDY_AFTER_FREE: { |
492 | unsigned long p = __get_free_page(GFP_KERNEL); | |
493 | if (!p) | |
494 | break; | |
495 | pr_info("Writing to the buddy page before free\n"); | |
496 | memset((void *)p, 0x3, PAGE_SIZE); | |
497 | free_page(p); | |
0347af4e | 498 | schedule(); |
920d451f LA |
499 | pr_info("Attempting bad write to the buddy page after free\n"); |
500 | memset((void *)p, 0x78, PAGE_SIZE); | |
7c0ae5be KC |
501 | /* Attempt to notice the overwrite. */ |
502 | p = __get_free_page(GFP_KERNEL); | |
503 | free_page(p); | |
0347af4e | 504 | schedule(); |
7c0ae5be | 505 | |
920d451f LA |
506 | break; |
507 | } | |
508 | case CT_READ_BUDDY_AFTER_FREE: { | |
509 | unsigned long p = __get_free_page(GFP_KERNEL); | |
50fbd977 | 510 | int saw, *val; |
920d451f LA |
511 | int *base; |
512 | ||
513 | if (!p) | |
514 | break; | |
515 | ||
50fbd977 | 516 | val = kmalloc(1024, GFP_KERNEL); |
3d085c74 KC |
517 | if (!val) { |
518 | free_page(p); | |
920d451f | 519 | break; |
3d085c74 | 520 | } |
920d451f LA |
521 | |
522 | base = (int *)p; | |
523 | ||
524 | *val = 0x12345678; | |
525 | base[0] = *val; | |
526 | pr_info("Value in memory before free: %x\n", base[0]); | |
527 | free_page(p); | |
528 | pr_info("Attempting to read from freed memory\n"); | |
529 | saw = base[0]; | |
530 | if (saw != *val) { | |
531 | /* Good! Poisoning happened, so declare a win. */ | |
7c0ae5be | 532 | pr_info("Memory correctly poisoned (%x)\n", saw); |
920d451f LA |
533 | BUG(); |
534 | } | |
535 | pr_info("Buddy page was not poisoned\n"); | |
536 | ||
537 | kfree(val); | |
0347af4e SK |
538 | break; |
539 | } | |
93e2f585 | 540 | case CT_SOFTLOCKUP: |
a48223f9 FW |
541 | preempt_disable(); |
542 | for (;;) | |
543 | cpu_relax(); | |
544 | break; | |
93e2f585 | 545 | case CT_HARDLOCKUP: |
a48223f9 FW |
546 | local_irq_disable(); |
547 | for (;;) | |
548 | cpu_relax(); | |
549 | break; | |
274a5855 KC |
550 | case CT_SPINLOCKUP: |
551 | /* Must be called twice to trigger. */ | |
552 | spin_lock(&lock_me_up); | |
5123662a KC |
553 | /* Let sparse know we intended to exit holding the lock. */ |
554 | __release(&lock_me_up); | |
274a5855 | 555 | break; |
93e2f585 | 556 | case CT_HUNG_TASK: |
a48223f9 FW |
557 | set_current_state(TASK_UNINTERRUPTIBLE); |
558 | schedule(); | |
559 | break; | |
cc33c537 | 560 | case CT_EXEC_DATA: |
9a49a528 | 561 | execute_location(data_area, true); |
cc33c537 KC |
562 | break; |
563 | case CT_EXEC_STACK: { | |
564 | u8 stack_area[EXEC_SIZE]; | |
9a49a528 | 565 | execute_location(stack_area, true); |
cc33c537 KC |
566 | break; |
567 | } | |
568 | case CT_EXEC_KMALLOC: { | |
569 | u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL); | |
9a49a528 | 570 | execute_location(kmalloc_area, true); |
cc33c537 KC |
571 | kfree(kmalloc_area); |
572 | break; | |
573 | } | |
574 | case CT_EXEC_VMALLOC: { | |
575 | u32 *vmalloc_area = vmalloc(EXEC_SIZE); | |
9a49a528 | 576 | execute_location(vmalloc_area, true); |
cc33c537 KC |
577 | vfree(vmalloc_area); |
578 | break; | |
579 | } | |
9a49a528 KC |
580 | case CT_EXEC_RODATA: |
581 | execute_location(lkdtm_rodata_do_nothing, false); | |
582 | break; | |
9ae113ce KC |
583 | case CT_EXEC_USERSPACE: { |
584 | unsigned long user_addr; | |
585 | ||
586 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, | |
587 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
588 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
589 | if (user_addr >= TASK_SIZE) { | |
590 | pr_warn("Failed to allocate user memory\n"); | |
591 | return; | |
592 | } | |
593 | execute_user_location((void *)user_addr); | |
594 | vm_munmap(user_addr, PAGE_SIZE); | |
595 | break; | |
596 | } | |
597 | case CT_ACCESS_USERSPACE: { | |
2cb202c1 | 598 | unsigned long user_addr, tmp = 0; |
9ae113ce KC |
599 | unsigned long *ptr; |
600 | ||
601 | user_addr = vm_mmap(NULL, 0, PAGE_SIZE, | |
602 | PROT_READ | PROT_WRITE | PROT_EXEC, | |
603 | MAP_ANONYMOUS | MAP_PRIVATE, 0); | |
604 | if (user_addr >= TASK_SIZE) { | |
605 | pr_warn("Failed to allocate user memory\n"); | |
606 | return; | |
607 | } | |
608 | ||
2cb202c1 SS |
609 | if (copy_to_user((void __user *)user_addr, &tmp, sizeof(tmp))) { |
610 | pr_warn("copy_to_user failed\n"); | |
611 | vm_munmap(user_addr, PAGE_SIZE); | |
612 | return; | |
613 | } | |
614 | ||
9ae113ce | 615 | ptr = (unsigned long *)user_addr; |
aac416fc KC |
616 | |
617 | pr_info("attempting bad read at %p\n", ptr); | |
9ae113ce KC |
618 | tmp = *ptr; |
619 | tmp += 0xc0dec0de; | |
aac416fc KC |
620 | |
621 | pr_info("attempting bad write at %p\n", ptr); | |
9ae113ce KC |
622 | *ptr = tmp; |
623 | ||
624 | vm_munmap(user_addr, PAGE_SIZE); | |
625 | ||
626 | break; | |
627 | } | |
628 | case CT_WRITE_RO: { | |
7cca071c KC |
629 | /* Explicitly cast away "const" for the test. */ |
630 | unsigned long *ptr = (unsigned long *)&rodata; | |
9ae113ce | 631 | |
7cca071c KC |
632 | pr_info("attempting bad rodata write at %p\n", ptr); |
633 | *ptr ^= 0xabcd1234; | |
aac416fc | 634 | |
7cca071c KC |
635 | break; |
636 | } | |
637 | case CT_WRITE_RO_AFTER_INIT: { | |
638 | unsigned long *ptr = &ro_after_init; | |
639 | ||
640 | /* | |
641 | * Verify we were written to during init. Since an Oops | |
642 | * is considered a "success", a failure is to just skip the | |
643 | * real test. | |
644 | */ | |
645 | if ((*ptr & 0xAA) != 0xAA) { | |
646 | pr_info("%p was NOT written during init!?\n", ptr); | |
647 | break; | |
648 | } | |
649 | ||
650 | pr_info("attempting bad ro_after_init write at %p\n", ptr); | |
9ae113ce KC |
651 | *ptr ^= 0xabcd1234; |
652 | ||
653 | break; | |
654 | } | |
dc2b9e90 KC |
655 | case CT_WRITE_KERN: { |
656 | size_t size; | |
657 | unsigned char *ptr; | |
658 | ||
659 | size = (unsigned long)do_overwritten - | |
660 | (unsigned long)do_nothing; | |
661 | ptr = (unsigned char *)do_overwritten; | |
662 | ||
663 | pr_info("attempting bad %zu byte write at %p\n", size, ptr); | |
664 | memcpy(ptr, (unsigned char *)do_nothing, size); | |
665 | flush_icache_range((unsigned long)ptr, | |
666 | (unsigned long)(ptr + size)); | |
667 | ||
668 | do_overwritten(); | |
669 | break; | |
670 | } | |
5fd9e480 DW |
671 | case CT_WRAP_ATOMIC: { |
672 | atomic_t under = ATOMIC_INIT(INT_MIN); | |
673 | atomic_t over = ATOMIC_INIT(INT_MAX); | |
674 | ||
675 | pr_info("attempting atomic underflow\n"); | |
676 | atomic_dec(&under); | |
677 | pr_info("attempting atomic overflow\n"); | |
678 | atomic_inc(&over); | |
679 | ||
680 | return; | |
681 | } | |
93e2f585 | 682 | case CT_NONE: |
0347af4e SK |
683 | default: |
684 | break; | |
685 | } | |
686 | ||
687 | } | |
688 | ||
689 | static void lkdtm_handler(void) | |
690 | { | |
aa2c96d6 | 691 | unsigned long flags; |
92618184 | 692 | bool do_it = false; |
aa2c96d6 JH |
693 | |
694 | spin_lock_irqsave(&count_lock, flags); | |
0347af4e | 695 | count--; |
feac6e21 KC |
696 | pr_info("Crash point %s of type %s hit, trigger in %d rounds\n", |
697 | cp_name_to_str(cpoint), cp_type_to_str(cptype), count); | |
8bb31b9d AG |
698 | |
699 | if (count == 0) { | |
92618184 | 700 | do_it = true; |
8bb31b9d AG |
701 | count = cpoint_count; |
702 | } | |
aa2c96d6 | 703 | spin_unlock_irqrestore(&count_lock, flags); |
92618184 CW |
704 | |
705 | if (do_it) | |
706 | lkdtm_do_action(cptype); | |
8bb31b9d AG |
707 | } |
708 | ||
0347af4e | 709 | static int lkdtm_register_cpoint(enum cname which) |
8bb31b9d AG |
710 | { |
711 | int ret; | |
712 | ||
93e2f585 | 713 | cpoint = CN_INVALID; |
0347af4e SK |
714 | if (lkdtm.entry != NULL) |
715 | unregister_jprobe(&lkdtm); | |
8bb31b9d | 716 | |
0347af4e | 717 | switch (which) { |
93e2f585 | 718 | case CN_DIRECT: |
0347af4e SK |
719 | lkdtm_do_action(cptype); |
720 | return 0; | |
93e2f585 | 721 | case CN_INT_HARDWARE_ENTRY: |
f58f2fa9 | 722 | lkdtm.kp.symbol_name = "do_IRQ"; |
8bb31b9d AG |
723 | lkdtm.entry = (kprobe_opcode_t*) jp_do_irq; |
724 | break; | |
93e2f585 | 725 | case CN_INT_HW_IRQ_EN: |
8bb31b9d AG |
726 | lkdtm.kp.symbol_name = "handle_IRQ_event"; |
727 | lkdtm.entry = (kprobe_opcode_t*) jp_handle_irq_event; | |
728 | break; | |
93e2f585 | 729 | case CN_INT_TASKLET_ENTRY: |
8bb31b9d AG |
730 | lkdtm.kp.symbol_name = "tasklet_action"; |
731 | lkdtm.entry = (kprobe_opcode_t*) jp_tasklet_action; | |
732 | break; | |
93e2f585 | 733 | case CN_FS_DEVRW: |
8bb31b9d AG |
734 | lkdtm.kp.symbol_name = "ll_rw_block"; |
735 | lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block; | |
736 | break; | |
93e2f585 | 737 | case CN_MEM_SWAPOUT: |
18a61e4a AG |
738 | lkdtm.kp.symbol_name = "shrink_inactive_list"; |
739 | lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list; | |
8bb31b9d | 740 | break; |
93e2f585 | 741 | case CN_TIMERADD: |
8bb31b9d AG |
742 | lkdtm.kp.symbol_name = "hrtimer_start"; |
743 | lkdtm.entry = (kprobe_opcode_t*) jp_hrtimer_start; | |
744 | break; | |
93e2f585 | 745 | case CN_SCSI_DISPATCH_CMD: |
8bb31b9d AG |
746 | lkdtm.kp.symbol_name = "scsi_dispatch_cmd"; |
747 | lkdtm.entry = (kprobe_opcode_t*) jp_scsi_dispatch_cmd; | |
748 | break; | |
93e2f585 | 749 | case CN_IDE_CORE_CP: |
8bb31b9d AG |
750 | #ifdef CONFIG_IDE |
751 | lkdtm.kp.symbol_name = "generic_ide_ioctl"; | |
752 | lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl; | |
753 | #else | |
feac6e21 | 754 | pr_info("Crash point not available\n"); |
0347af4e | 755 | return -EINVAL; |
8bb31b9d AG |
756 | #endif |
757 | break; | |
758 | default: | |
feac6e21 | 759 | pr_info("Invalid Crash Point\n"); |
0347af4e | 760 | return -EINVAL; |
8bb31b9d AG |
761 | } |
762 | ||
0347af4e | 763 | cpoint = which; |
8bb31b9d | 764 | if ((ret = register_jprobe(&lkdtm)) < 0) { |
feac6e21 | 765 | pr_info("Couldn't register jprobe\n"); |
93e2f585 | 766 | cpoint = CN_INVALID; |
0347af4e SK |
767 | } |
768 | ||
769 | return ret; | |
770 | } | |
771 | ||
772 | static ssize_t do_register_entry(enum cname which, struct file *f, | |
773 | const char __user *user_buf, size_t count, loff_t *off) | |
774 | { | |
775 | char *buf; | |
776 | int err; | |
777 | ||
778 | if (count >= PAGE_SIZE) | |
779 | return -EINVAL; | |
780 | ||
781 | buf = (char *)__get_free_page(GFP_KERNEL); | |
782 | if (!buf) | |
783 | return -ENOMEM; | |
784 | if (copy_from_user(buf, user_buf, count)) { | |
785 | free_page((unsigned long) buf); | |
786 | return -EFAULT; | |
787 | } | |
788 | /* NULL-terminate and remove enter */ | |
789 | buf[count] = '\0'; | |
790 | strim(buf); | |
791 | ||
792 | cptype = parse_cp_type(buf, count); | |
793 | free_page((unsigned long) buf); | |
794 | ||
93e2f585 | 795 | if (cptype == CT_NONE) |
0347af4e SK |
796 | return -EINVAL; |
797 | ||
798 | err = lkdtm_register_cpoint(which); | |
799 | if (err < 0) | |
800 | return err; | |
801 | ||
802 | *off += count; | |
803 | ||
804 | return count; | |
805 | } | |
806 | ||
807 | /* Generic read callback that just prints out the available crash types */ | |
808 | static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf, | |
809 | size_t count, loff_t *off) | |
810 | { | |
811 | char *buf; | |
812 | int i, n, out; | |
813 | ||
814 | buf = (char *)__get_free_page(GFP_KERNEL); | |
086ff4b3 AC |
815 | if (buf == NULL) |
816 | return -ENOMEM; | |
0347af4e SK |
817 | |
818 | n = snprintf(buf, PAGE_SIZE, "Available crash types:\n"); | |
819 | for (i = 0; i < ARRAY_SIZE(cp_type); i++) | |
820 | n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]); | |
821 | buf[n] = '\0'; | |
822 | ||
823 | out = simple_read_from_buffer(user_buf, count, off, | |
824 | buf, n); | |
825 | free_page((unsigned long) buf); | |
826 | ||
827 | return out; | |
828 | } | |
829 | ||
830 | static int lkdtm_debugfs_open(struct inode *inode, struct file *file) | |
831 | { | |
832 | return 0; | |
833 | } | |
834 | ||
835 | ||
836 | static ssize_t int_hardware_entry(struct file *f, const char __user *buf, | |
837 | size_t count, loff_t *off) | |
838 | { | |
93e2f585 | 839 | return do_register_entry(CN_INT_HARDWARE_ENTRY, f, buf, count, off); |
0347af4e SK |
840 | } |
841 | ||
842 | static ssize_t int_hw_irq_en(struct file *f, const char __user *buf, | |
843 | size_t count, loff_t *off) | |
844 | { | |
93e2f585 | 845 | return do_register_entry(CN_INT_HW_IRQ_EN, f, buf, count, off); |
0347af4e SK |
846 | } |
847 | ||
848 | static ssize_t int_tasklet_entry(struct file *f, const char __user *buf, | |
849 | size_t count, loff_t *off) | |
850 | { | |
93e2f585 | 851 | return do_register_entry(CN_INT_TASKLET_ENTRY, f, buf, count, off); |
0347af4e SK |
852 | } |
853 | ||
854 | static ssize_t fs_devrw_entry(struct file *f, const char __user *buf, | |
855 | size_t count, loff_t *off) | |
856 | { | |
93e2f585 | 857 | return do_register_entry(CN_FS_DEVRW, f, buf, count, off); |
0347af4e SK |
858 | } |
859 | ||
860 | static ssize_t mem_swapout_entry(struct file *f, const char __user *buf, | |
861 | size_t count, loff_t *off) | |
862 | { | |
93e2f585 | 863 | return do_register_entry(CN_MEM_SWAPOUT, f, buf, count, off); |
0347af4e SK |
864 | } |
865 | ||
866 | static ssize_t timeradd_entry(struct file *f, const char __user *buf, | |
867 | size_t count, loff_t *off) | |
868 | { | |
93e2f585 | 869 | return do_register_entry(CN_TIMERADD, f, buf, count, off); |
0347af4e SK |
870 | } |
871 | ||
872 | static ssize_t scsi_dispatch_cmd_entry(struct file *f, | |
873 | const char __user *buf, size_t count, loff_t *off) | |
874 | { | |
93e2f585 | 875 | return do_register_entry(CN_SCSI_DISPATCH_CMD, f, buf, count, off); |
0347af4e SK |
876 | } |
877 | ||
878 | static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf, | |
879 | size_t count, loff_t *off) | |
880 | { | |
93e2f585 | 881 | return do_register_entry(CN_IDE_CORE_CP, f, buf, count, off); |
0347af4e SK |
882 | } |
883 | ||
884 | /* Special entry to just crash directly. Available without KPROBEs */ | |
885 | static ssize_t direct_entry(struct file *f, const char __user *user_buf, | |
886 | size_t count, loff_t *off) | |
887 | { | |
888 | enum ctype type; | |
889 | char *buf; | |
890 | ||
891 | if (count >= PAGE_SIZE) | |
892 | return -EINVAL; | |
893 | if (count < 1) | |
894 | return -EINVAL; | |
895 | ||
896 | buf = (char *)__get_free_page(GFP_KERNEL); | |
897 | if (!buf) | |
898 | return -ENOMEM; | |
899 | if (copy_from_user(buf, user_buf, count)) { | |
900 | free_page((unsigned long) buf); | |
901 | return -EFAULT; | |
902 | } | |
903 | /* NULL-terminate and remove enter */ | |
904 | buf[count] = '\0'; | |
905 | strim(buf); | |
906 | ||
907 | type = parse_cp_type(buf, count); | |
908 | free_page((unsigned long) buf); | |
93e2f585 | 909 | if (type == CT_NONE) |
0347af4e SK |
910 | return -EINVAL; |
911 | ||
feac6e21 | 912 | pr_info("Performing direct entry %s\n", cp_type_to_str(type)); |
0347af4e SK |
913 | lkdtm_do_action(type); |
914 | *off += count; | |
915 | ||
916 | return count; | |
917 | } | |
918 | ||
919 | struct crash_entry { | |
920 | const char *name; | |
921 | const struct file_operations fops; | |
922 | }; | |
923 | ||
924 | static const struct crash_entry crash_entries[] = { | |
925 | {"DIRECT", {.read = lkdtm_debugfs_read, | |
05271ec4 | 926 | .llseek = generic_file_llseek, |
0347af4e SK |
927 | .open = lkdtm_debugfs_open, |
928 | .write = direct_entry} }, | |
929 | {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read, | |
05271ec4 | 930 | .llseek = generic_file_llseek, |
0347af4e SK |
931 | .open = lkdtm_debugfs_open, |
932 | .write = int_hardware_entry} }, | |
933 | {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read, | |
05271ec4 | 934 | .llseek = generic_file_llseek, |
0347af4e SK |
935 | .open = lkdtm_debugfs_open, |
936 | .write = int_hw_irq_en} }, | |
937 | {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read, | |
05271ec4 | 938 | .llseek = generic_file_llseek, |
0347af4e SK |
939 | .open = lkdtm_debugfs_open, |
940 | .write = int_tasklet_entry} }, | |
941 | {"FS_DEVRW", {.read = lkdtm_debugfs_read, | |
05271ec4 | 942 | .llseek = generic_file_llseek, |
0347af4e SK |
943 | .open = lkdtm_debugfs_open, |
944 | .write = fs_devrw_entry} }, | |
945 | {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read, | |
05271ec4 | 946 | .llseek = generic_file_llseek, |
0347af4e SK |
947 | .open = lkdtm_debugfs_open, |
948 | .write = mem_swapout_entry} }, | |
949 | {"TIMERADD", {.read = lkdtm_debugfs_read, | |
05271ec4 | 950 | .llseek = generic_file_llseek, |
0347af4e SK |
951 | .open = lkdtm_debugfs_open, |
952 | .write = timeradd_entry} }, | |
953 | {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read, | |
05271ec4 | 954 | .llseek = generic_file_llseek, |
0347af4e SK |
955 | .open = lkdtm_debugfs_open, |
956 | .write = scsi_dispatch_cmd_entry} }, | |
957 | {"IDE_CORE_CP", {.read = lkdtm_debugfs_read, | |
05271ec4 | 958 | .llseek = generic_file_llseek, |
0347af4e SK |
959 | .open = lkdtm_debugfs_open, |
960 | .write = ide_core_cp_entry} }, | |
961 | }; | |
962 | ||
963 | static struct dentry *lkdtm_debugfs_root; | |
964 | ||
965 | static int __init lkdtm_module_init(void) | |
966 | { | |
967 | int ret = -EINVAL; | |
968 | int n_debugfs_entries = 1; /* Assume only the direct entry */ | |
969 | int i; | |
970 | ||
7cca071c KC |
971 | /* Make sure we can write to __ro_after_init values during __init */ |
972 | ro_after_init |= 0xAA; | |
973 | ||
0347af4e SK |
974 | /* Register debugfs interface */ |
975 | lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL); | |
976 | if (!lkdtm_debugfs_root) { | |
feac6e21 | 977 | pr_err("creating root dir failed\n"); |
0347af4e SK |
978 | return -ENODEV; |
979 | } | |
980 | ||
981 | #ifdef CONFIG_KPROBES | |
982 | n_debugfs_entries = ARRAY_SIZE(crash_entries); | |
983 | #endif | |
984 | ||
985 | for (i = 0; i < n_debugfs_entries; i++) { | |
986 | const struct crash_entry *cur = &crash_entries[i]; | |
987 | struct dentry *de; | |
988 | ||
989 | de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root, | |
990 | NULL, &cur->fops); | |
991 | if (de == NULL) { | |
feac6e21 | 992 | pr_err("could not create %s\n", cur->name); |
0347af4e SK |
993 | goto out_err; |
994 | } | |
995 | } | |
996 | ||
997 | if (lkdtm_parse_commandline() == -EINVAL) { | |
feac6e21 | 998 | pr_info("Invalid command\n"); |
0347af4e SK |
999 | goto out_err; |
1000 | } | |
1001 | ||
93e2f585 | 1002 | if (cpoint != CN_INVALID && cptype != CT_NONE) { |
0347af4e SK |
1003 | ret = lkdtm_register_cpoint(cpoint); |
1004 | if (ret < 0) { | |
feac6e21 | 1005 | pr_info("Invalid crash point %d\n", cpoint); |
0347af4e SK |
1006 | goto out_err; |
1007 | } | |
feac6e21 KC |
1008 | pr_info("Crash point %s of type %s registered\n", |
1009 | cpoint_name, cpoint_type); | |
0347af4e | 1010 | } else { |
feac6e21 | 1011 | pr_info("No crash points registered, enable through debugfs\n"); |
8bb31b9d AG |
1012 | } |
1013 | ||
8bb31b9d | 1014 | return 0; |
0347af4e SK |
1015 | |
1016 | out_err: | |
1017 | debugfs_remove_recursive(lkdtm_debugfs_root); | |
1018 | return ret; | |
8bb31b9d AG |
1019 | } |
1020 | ||
2118116e | 1021 | static void __exit lkdtm_module_exit(void) |
8bb31b9d | 1022 | { |
0347af4e SK |
1023 | debugfs_remove_recursive(lkdtm_debugfs_root); |
1024 | ||
1025 | unregister_jprobe(&lkdtm); | |
feac6e21 | 1026 | pr_info("Crash point unregistered\n"); |
8bb31b9d AG |
1027 | } |
1028 | ||
1029 | module_init(lkdtm_module_init); | |
1030 | module_exit(lkdtm_module_exit); | |
1031 | ||
1032 | MODULE_LICENSE("GPL"); | |
da86920f | 1033 | MODULE_DESCRIPTION("Kprobe module for testing crash dumps"); |