lkdtm: Relocate code to subdirectory (811cf3dd) · Commits · e / devices / android_kernel_sony_msm8994

MAINTAINERS

+5 −0

Original line number	Diff line number	Diff line
		@@ -4955,6 +4955,11 @@ F: arch/powerpc/platforms/pasemi/
		F: drivers//pasemi*
		F: drivers///pasemi

		LINUX KERNEL DUMP TEST MODULE (LKDTM)
		M: Kees Cook <keescook@chromium.org>
		S: Maintained
		F: drivers/misc/lkdtm/*

		LINUX SECURITY MODULE (LSM) FRAMEWORK
		M: Chris Wright <chrisw@sous-sol.org>
		L: linux-security-module@vger.kernel.org

drivers/misc/Makefile

+1 −1

Original line number	Diff line number	Diff line
		@@ -15,7 +15,7 @@ obj-$(CONFIG_BMP085_I2C) += bmp085-i2c.o
		obj-$(CONFIG_BMP085_SPI) += bmp085-spi.o
		obj-$(CONFIG_DUMMY_IRQ) += dummy-irq.o
		obj-$(CONFIG_ICS932S401) += ics932s401.o
		obj-$(CONFIG_LKDTM) += lkdtm.o
		obj-$(CONFIG_LKDTM) += lkdtm/
		obj-$(CONFIG_TIFM_CORE) += tifm_core.o
		obj-$(CONFIG_TIFM_7XX1) += tifm_7xx1.o
		obj-$(CONFIG_PHANTOM) += phantom.o

drivers/misc/lkdtm/Makefile

0 → 100644

+20 −0

Original line number	Diff line number	Diff line
		# SPDX-License-Identifier: GPL-2.0
		obj-$(CONFIG_LKDTM) += lkdtm.o

		lkdtm-$(CONFIG_LKDTM) += core.o
		lkdtm-$(CONFIG_LKDTM) += bugs.o
		lkdtm-$(CONFIG_LKDTM) += heap.o
		lkdtm-$(CONFIG_LKDTM) += perms.o
		lkdtm-$(CONFIG_LKDTM) += refcount.o
		lkdtm-$(CONFIG_LKDTM) += rodata_objcopy.o
		lkdtm-$(CONFIG_LKDTM) += usercopy.o

		KCOV_INSTRUMENT_rodata.o := n

		OBJCOPYFLAGS :=
		OBJCOPYFLAGS_rodata_objcopy.o := \
		--set-section-flags .text=alloc,readonly \
		--rename-section .text=.rodata
		targets += rodata.o rodata_objcopy.o
		$(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
		$(call if_changed,objcopy)

drivers/misc/lkdtm/bugs.c

0 → 100644

+257 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0
		/*
		* This is for all the tests related to logic bugs (e.g. bad dereferences,
		* bad alignment, bad loops, bad locking, bad scheduling, deep stacks, and
		* lockups) along with other things that don't fit well into existing LKDTM
		* test source files.
		*/
		#include "lkdtm.h"
		#include <linux/list.h>
		#include <linux/sched.h>
		#include <linux/sched/signal.h>
		#include <linux/sched/task_stack.h>
		#include <linux/uaccess.h>

		struct lkdtm_list {
		struct list_head node;
		};

		/*
		* Make sure our attempts to over run the kernel stack doesn't trigger
		* a compiler warning when CONFIG_FRAME_WARN is set. Then make sure we
		* recurse past the end of THREAD_SIZE by default.
		*/
		#if defined(CONFIG_FRAME_WARN) && (CONFIG_FRAME_WARN > 0)
		#define REC_STACK_SIZE (CONFIG_FRAME_WARN / 2)
		#else
		#define REC_STACK_SIZE (THREAD_SIZE / 8)
		#endif
		#define REC_NUM_DEFAULT ((THREAD_SIZE / REC_STACK_SIZE) * 2)

		static int recur_count = REC_NUM_DEFAULT;

		static DEFINE_SPINLOCK(lock_me_up);

		static int recursive_loop(int remaining)
		{
		char buf[REC_STACK_SIZE];

		/* Make sure compiler does not optimize this away. */
		memset(buf, (remaining & 0xff) \| 0x1, REC_STACK_SIZE);
		if (!remaining)
		return 0;
		else
		return recursive_loop(remaining - 1);
		}

		/* If the depth is negative, use the default, otherwise keep parameter. */
		void __init lkdtm_bugs_init(int *recur_param)
		{
		if (*recur_param < 0)
		*recur_param = recur_count;
		else
		recur_count = *recur_param;
		}

		void lkdtm_PANIC(void)
		{
		panic("dumptest");
		}

		void lkdtm_BUG(void)
		{
		BUG();
		}

		static int warn_counter;

		void lkdtm_WARNING(void)
		{
		WARN(1, "Warning message trigger count: %d\n", warn_counter++);
		}

		void lkdtm_EXCEPTION(void)
		{
		((volatile int ) 0) = 0;
		}

		void lkdtm_LOOP(void)
		{
		for (;;)
		;
		}

		void lkdtm_OVERFLOW(void)
		{
		(void) recursive_loop(recur_count);
		}

		static noinline void __lkdtm_CORRUPT_STACK(void *stack)
		{
		memset(stack, '\xff', 64);
		}

		/* This should trip the stack canary, not corrupt the return address. */
		noinline void lkdtm_CORRUPT_STACK(void)
		{
		/* Use default char array length that triggers stack protection. */
		char data[8] __aligned(sizeof(void *));

		__lkdtm_CORRUPT_STACK(&data);

		pr_info("Corrupted stack containing char array ...\n");
		}

		/* Same as above but will only get a canary with -fstack-protector-strong */
		noinline void lkdtm_CORRUPT_STACK_STRONG(void)
		{
		union {
		unsigned short shorts[4];
		unsigned long *ptr;
		} data __aligned(sizeof(void *));

		__lkdtm_CORRUPT_STACK(&data);

		pr_info("Corrupted stack containing union ...\n");
		}

		void lkdtm_UNALIGNED_LOAD_STORE_WRITE(void)
		{
		static u8 data[5] __attribute__((aligned(4))) = {1, 2, 3, 4, 5};
		u32 *p;
		u32 val = 0x12345678;

		p = (u32 *)(data + 1);
		if (*p == 0)
		val = 0x87654321;
		*p = val;
		}

		void lkdtm_SOFTLOCKUP(void)
		{
		preempt_disable();
		for (;;)
		cpu_relax();
		}

		void lkdtm_HARDLOCKUP(void)
		{
		local_irq_disable();
		for (;;)
		cpu_relax();
		}

		void lkdtm_SPINLOCKUP(void)
		{
		/* Must be called twice to trigger. */
		spin_lock(&lock_me_up);
		/* Let sparse know we intended to exit holding the lock. */
		__release(&lock_me_up);
		}

		void lkdtm_HUNG_TASK(void)
		{
		set_current_state(TASK_UNINTERRUPTIBLE);
		schedule();
		}

		void lkdtm_CORRUPT_LIST_ADD(void)
		{
		/*
		* Initially, an empty list via LIST_HEAD:
		* test_head.next = &test_head
		* test_head.prev = &test_head
		*/
		LIST_HEAD(test_head);
		struct lkdtm_list good, bad;
		void *target[2] = { };
		void *redirection = &target;

		pr_info("attempting good list addition\n");

		/*
		* Adding to the list performs these actions:
		* test_head.next->prev = &good.node
		* good.node.next = test_head.next
		* good.node.prev = test_head
		* test_head.next = good.node
		*/
		list_add(&good.node, &test_head);

		pr_info("attempting corrupted list addition\n");
		/*
		* In simulating this "write what where" primitive, the "what" is
		* the address of &bad.node, and the "where" is the address held
		* by "redirection".
		*/
		test_head.next = redirection;
		list_add(&bad.node, &test_head);

		if (target[0] == NULL && target[1] == NULL)
		pr_err("Overwrite did not happen, but no BUG?!\n");
		else
		pr_err("list_add() corruption not detected!\n");
		}

		void lkdtm_CORRUPT_LIST_DEL(void)
		{
		LIST_HEAD(test_head);
		struct lkdtm_list item;
		void *target[2] = { };
		void *redirection = &target;

		list_add(&item.node, &test_head);

		pr_info("attempting good list removal\n");
		list_del(&item.node);

		pr_info("attempting corrupted list removal\n");
		list_add(&item.node, &test_head);

		/* As with the list_add() test above, this corrupts "next". */
		item.node.next = redirection;
		list_del(&item.node);

		if (target[0] == NULL && target[1] == NULL)
		pr_err("Overwrite did not happen, but no BUG?!\n");
		else
		pr_err("list_del() corruption not detected!\n");
		}

		/* Test if unbalanced set_fs(KERNEL_DS)/set_fs(USER_DS) check exists. */
		void lkdtm_CORRUPT_USER_DS(void)
		{
		pr_info("setting bad task size limit\n");
		set_fs(KERNEL_DS);

		/* Make sure we do not keep running with a KERNEL_DS! */
		force_sig(SIGKILL, current);
		}

		/* Test that VMAP_STACK is actually allocating with a leading guard page */
		void lkdtm_STACK_GUARD_PAGE_LEADING(void)
		{
		const unsigned char *stack = task_stack_page(current);
		const unsigned char *ptr = stack - 1;
		volatile unsigned char byte;

		pr_info("attempting bad read from page below current stack\n");

		byte = *ptr;

		pr_err("FAIL: accessed page before stack!\n");
		}

		/* Test that VMAP_STACK is actually allocating with a trailing guard page */
		void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
		{
		const unsigned char *stack = task_stack_page(current);
		const unsigned char *ptr = stack + THREAD_SIZE;
		volatile unsigned char byte;

		pr_info("attempting bad read from page above current stack\n");

		byte = *ptr;

		pr_err("FAIL: accessed page after stack!\n");
		}

drivers/misc/lkdtm/core.c

0 → 100644

+505 −0

Original line number	Diff line number	Diff line
		/*
		* Linux Kernel Dump Test Module for testing kernel crashes conditions:
		* induces system failures at predefined crashpoints and under predefined
		* operational conditions in order to evaluate the reliability of kernel
		* sanity checking and crash dumps obtained using different dumping
		* solutions.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License as published by
		* the Free Software Foundation; either version 2 of the License, or
		* (at your option) any later version.
		*
		* This program is distributed in the hope that it will be useful,
		* but WITHOUT ANY WARRANTY; without even the implied warranty of
		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		* GNU General Public License for more details.
		*
		* You should have received a copy of the GNU General Public License
		* along with this program; if not, write to the Free Software
		* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
		*
		* Copyright (C) IBM Corporation, 2006
		*
		* Author: Ankita Garg <ankita@in.ibm.com>
		*
		* It is adapted from the Linux Kernel Dump Test Tool by
		* Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
		*
		* Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
		*
		* See Documentation/fault-injection/provoke-crashes.txt for instructions
		*/
		#include "lkdtm.h"
		#include <linux/fs.h>
		#include <linux/module.h>
		#include <linux/buffer_head.h>
		#include <linux/kprobes.h>
		#include <linux/list.h>
		#include <linux/init.h>
		#include <linux/interrupt.h>
		#include <linux/hrtimer.h>
		#include <linux/slab.h>
		#include <scsi/scsi_cmnd.h>
		#include <linux/debugfs.h>

		#ifdef CONFIG_IDE
		#include <linux/ide.h>
		#endif

		#define DEFAULT_COUNT 10

		static int lkdtm_debugfs_open(struct inode inode, struct file file);
		static ssize_t lkdtm_debugfs_read(struct file f, char __user user_buf,
		size_t count, loff_t *off);
		static ssize_t direct_entry(struct file f, const char __user user_buf,
		size_t count, loff_t *off);

		#ifdef CONFIG_KPROBES
		static int lkdtm_kprobe_handler(struct kprobe kp, struct pt_regs regs);
		static ssize_t lkdtm_debugfs_entry(struct file *f,
		const char __user *user_buf,
		size_t count, loff_t *off);
		# define CRASHPOINT_KPROBE(_symbol) \
		.kprobe = { \
		.symbol_name = (_symbol), \
		.pre_handler = lkdtm_kprobe_handler, \
		},
		# define CRASHPOINT_WRITE(_symbol) \
		(_symbol) ? lkdtm_debugfs_entry : direct_entry
		#else
		# define CRASHPOINT_KPROBE(_symbol)
		# define CRASHPOINT_WRITE(_symbol) direct_entry
		#endif

		/* Crash points */
		struct crashpoint {
		const char *name;
		const struct file_operations fops;
		struct kprobe kprobe;
		};

		#define CRASHPOINT(_name, _symbol) \
		{ \
		.name = _name, \
		.fops = { \
		.read = lkdtm_debugfs_read, \
		.llseek = generic_file_llseek, \
		.open = lkdtm_debugfs_open, \
		.write = CRASHPOINT_WRITE(_symbol) \
		}, \
		CRASHPOINT_KPROBE(_symbol) \
		}

		/* Define the possible places where we can trigger a crash point. */
		static struct crashpoint crashpoints[] = {
		CRASHPOINT("DIRECT", NULL),
		#ifdef CONFIG_KPROBES
		CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"),
		CRASHPOINT("INT_HW_IRQ_EN", "handle_irq_event"),
		CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"),
		CRASHPOINT("FS_DEVRW", "ll_rw_block"),
		CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"),
		CRASHPOINT("TIMERADD", "hrtimer_start"),
		CRASHPOINT("SCSI_DISPATCH_CMD", "scsi_dispatch_cmd"),
		# ifdef CONFIG_IDE
		CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"),
		# endif
		#endif
		};


		/* Crash types. */
		struct crashtype {
		const char *name;
		void (*func)(void);
		};

		#define CRASHTYPE(_name) \
		{ \
		.name = __stringify(_name), \
		.func = lkdtm_ ## _name, \
		}

		/* Define the possible types of crashes that can be triggered. */
		static const struct crashtype crashtypes[] = {
		CRASHTYPE(PANIC),
		CRASHTYPE(BUG),
		CRASHTYPE(WARNING),
		CRASHTYPE(EXCEPTION),
		CRASHTYPE(LOOP),
		CRASHTYPE(OVERFLOW),
		CRASHTYPE(CORRUPT_LIST_ADD),
		CRASHTYPE(CORRUPT_LIST_DEL),
		CRASHTYPE(CORRUPT_USER_DS),
		CRASHTYPE(CORRUPT_STACK),
		CRASHTYPE(CORRUPT_STACK_STRONG),
		CRASHTYPE(STACK_GUARD_PAGE_LEADING),
		CRASHTYPE(STACK_GUARD_PAGE_TRAILING),
		CRASHTYPE(UNALIGNED_LOAD_STORE_WRITE),
		CRASHTYPE(OVERWRITE_ALLOCATION),
		CRASHTYPE(WRITE_AFTER_FREE),
		CRASHTYPE(READ_AFTER_FREE),
		CRASHTYPE(WRITE_BUDDY_AFTER_FREE),
		CRASHTYPE(READ_BUDDY_AFTER_FREE),
		CRASHTYPE(SOFTLOCKUP),
		CRASHTYPE(HARDLOCKUP),
		CRASHTYPE(SPINLOCKUP),
		CRASHTYPE(HUNG_TASK),
		CRASHTYPE(EXEC_DATA),
		CRASHTYPE(EXEC_STACK),
		CRASHTYPE(EXEC_KMALLOC),
		CRASHTYPE(EXEC_VMALLOC),
		CRASHTYPE(EXEC_RODATA),
		CRASHTYPE(EXEC_USERSPACE),
		CRASHTYPE(ACCESS_USERSPACE),
		CRASHTYPE(WRITE_RO),
		CRASHTYPE(WRITE_RO_AFTER_INIT),
		CRASHTYPE(WRITE_KERN),
		CRASHTYPE(REFCOUNT_INC_OVERFLOW),
		CRASHTYPE(REFCOUNT_ADD_OVERFLOW),
		CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW),
		CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_OVERFLOW),
		CRASHTYPE(REFCOUNT_DEC_ZERO),
		CRASHTYPE(REFCOUNT_DEC_NEGATIVE),
		CRASHTYPE(REFCOUNT_DEC_AND_TEST_NEGATIVE),
		CRASHTYPE(REFCOUNT_SUB_AND_TEST_NEGATIVE),
		CRASHTYPE(REFCOUNT_INC_ZERO),
		CRASHTYPE(REFCOUNT_ADD_ZERO),
		CRASHTYPE(REFCOUNT_INC_SATURATED),
		CRASHTYPE(REFCOUNT_DEC_SATURATED),
		CRASHTYPE(REFCOUNT_ADD_SATURATED),
		CRASHTYPE(REFCOUNT_INC_NOT_ZERO_SATURATED),
		CRASHTYPE(REFCOUNT_ADD_NOT_ZERO_SATURATED),
		CRASHTYPE(REFCOUNT_DEC_AND_TEST_SATURATED),
		CRASHTYPE(REFCOUNT_SUB_AND_TEST_SATURATED),
		CRASHTYPE(REFCOUNT_TIMING),
		CRASHTYPE(ATOMIC_TIMING),
		CRASHTYPE(USERCOPY_HEAP_SIZE_TO),
		CRASHTYPE(USERCOPY_HEAP_SIZE_FROM),
		CRASHTYPE(USERCOPY_HEAP_WHITELIST_TO),
		CRASHTYPE(USERCOPY_HEAP_WHITELIST_FROM),
		CRASHTYPE(USERCOPY_STACK_FRAME_TO),
		CRASHTYPE(USERCOPY_STACK_FRAME_FROM),
		CRASHTYPE(USERCOPY_STACK_BEYOND),
		CRASHTYPE(USERCOPY_KERNEL),
		};


		/* Global kprobe entry and crashtype. */
		static struct kprobe *lkdtm_kprobe;
		static struct crashpoint *lkdtm_crashpoint;
		static const struct crashtype *lkdtm_crashtype;

		/* Module parameters */
		static int recur_count = -1;
		module_param(recur_count, int, 0644);
		MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test");

		static char* cpoint_name;
		module_param(cpoint_name, charp, 0444);
		MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");

		static char* cpoint_type;
		module_param(cpoint_type, charp, 0444);
		MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
		"hitting the crash point");

		static int cpoint_count = DEFAULT_COUNT;
		module_param(cpoint_count, int, 0644);
		MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
		"crash point is to be hit to trigger action");


		/* Return the crashtype number or NULL if the name is invalid */
		static const struct crashtype find_crashtype(const char name)
		{
		int i;

		for (i = 0; i < ARRAY_SIZE(crashtypes); i++) {
		if (!strcmp(name, crashtypes[i].name))
		return &crashtypes[i];
		}

		return NULL;
		}

		/*
		* This is forced noinline just so it distinctly shows up in the stackdump
		* which makes validation of expected lkdtm crashes easier.
		*/
		static noinline void lkdtm_do_action(const struct crashtype *crashtype)
		{
		if (WARN_ON(!crashtype \|\| !crashtype->func))
		return;
		crashtype->func();
		}

		static int lkdtm_register_cpoint(struct crashpoint *crashpoint,
		const struct crashtype *crashtype)
		{
		int ret;

		/* If this doesn't have a symbol, just call immediately. */
		if (!crashpoint->kprobe.symbol_name) {
		lkdtm_do_action(crashtype);
		return 0;
		}

		if (lkdtm_kprobe != NULL)
		unregister_kprobe(lkdtm_kprobe);

		lkdtm_crashpoint = crashpoint;
		lkdtm_crashtype = crashtype;
		lkdtm_kprobe = &crashpoint->kprobe;
		ret = register_kprobe(lkdtm_kprobe);
		if (ret < 0) {
		pr_info("Couldn't register kprobe %s\n",
		crashpoint->kprobe.symbol_name);
		lkdtm_kprobe = NULL;
		lkdtm_crashpoint = NULL;
		lkdtm_crashtype = NULL;
		}

		return ret;
		}

		#ifdef CONFIG_KPROBES
		/* Global crash counter and spinlock. */
		static int crash_count = DEFAULT_COUNT;
		static DEFINE_SPINLOCK(crash_count_lock);

		/* Called by kprobe entry points. */
		static int lkdtm_kprobe_handler(struct kprobe kp, struct pt_regs regs)
		{
		unsigned long flags;
		bool do_it = false;

		if (WARN_ON(!lkdtm_crashpoint \|\| !lkdtm_crashtype))
		return 0;

		spin_lock_irqsave(&crash_count_lock, flags);
		crash_count--;
		pr_info("Crash point %s of type %s hit, trigger in %d rounds\n",
		lkdtm_crashpoint->name, lkdtm_crashtype->name, crash_count);

		if (crash_count == 0) {
		do_it = true;
		crash_count = cpoint_count;
		}
		spin_unlock_irqrestore(&crash_count_lock, flags);

		if (do_it)
		lkdtm_do_action(lkdtm_crashtype);

		return 0;
		}

		static ssize_t lkdtm_debugfs_entry(struct file *f,
		const char __user *user_buf,
		size_t count, loff_t *off)
		{
		struct crashpoint *crashpoint = file_inode(f)->i_private;
		const struct crashtype *crashtype = NULL;
		char *buf;
		int err;

		if (count >= PAGE_SIZE)
		return -EINVAL;

		buf = (char *)__get_free_page(GFP_KERNEL);
		if (!buf)
		return -ENOMEM;
		if (copy_from_user(buf, user_buf, count)) {
		free_page((unsigned long) buf);
		return -EFAULT;
		}
		/* NULL-terminate and remove enter */
		buf[count] = '\0';
		strim(buf);

		crashtype = find_crashtype(buf);
		free_page((unsigned long)buf);

		if (!crashtype)
		return -EINVAL;

		err = lkdtm_register_cpoint(crashpoint, crashtype);
		if (err < 0)
		return err;

		*off += count;

		return count;
		}
		#endif

		/* Generic read callback that just prints out the available crash types */
		static ssize_t lkdtm_debugfs_read(struct file f, char __user user_buf,
		size_t count, loff_t *off)
		{
		char *buf;
		int i, n, out;

		buf = (char *)__get_free_page(GFP_KERNEL);
		if (buf == NULL)
		return -ENOMEM;

		n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
		for (i = 0; i < ARRAY_SIZE(crashtypes); i++) {
		n += snprintf(buf + n, PAGE_SIZE - n, "%s\n",
		crashtypes[i].name);
		}
		buf[n] = '\0';

		out = simple_read_from_buffer(user_buf, count, off,
		buf, n);
		free_page((unsigned long) buf);

		return out;
		}

		static int lkdtm_debugfs_open(struct inode inode, struct file file)
		{
		return 0;
		}

		/* Special entry to just crash directly. Available without KPROBEs */
		static ssize_t direct_entry(struct file f, const char __user user_buf,
		size_t count, loff_t *off)
		{
		const struct crashtype *crashtype;
		char *buf;

		if (count >= PAGE_SIZE)
		return -EINVAL;
		if (count < 1)
		return -EINVAL;

		buf = (char *)__get_free_page(GFP_KERNEL);
		if (!buf)
		return -ENOMEM;
		if (copy_from_user(buf, user_buf, count)) {
		free_page((unsigned long) buf);
		return -EFAULT;
		}
		/* NULL-terminate and remove enter */
		buf[count] = '\0';
		strim(buf);

		crashtype = find_crashtype(buf);
		free_page((unsigned long) buf);
		if (!crashtype)
		return -EINVAL;

		pr_info("Performing direct entry %s\n", crashtype->name);
		lkdtm_do_action(crashtype);
		*off += count;

		return count;
		}

		static struct dentry *lkdtm_debugfs_root;

		static int __init lkdtm_module_init(void)
		{
		struct crashpoint *crashpoint = NULL;
		const struct crashtype *crashtype = NULL;
		int ret = -EINVAL;
		int i;

		/* Neither or both of these need to be set */
		if ((cpoint_type \|\| cpoint_name) && !(cpoint_type && cpoint_name)) {
		pr_err("Need both cpoint_type and cpoint_name or neither\n");
		return -EINVAL;
		}

		if (cpoint_type) {
		crashtype = find_crashtype(cpoint_type);
		if (!crashtype) {
		pr_err("Unknown crashtype '%s'\n", cpoint_type);
		return -EINVAL;
		}
		}

		if (cpoint_name) {
		for (i = 0; i < ARRAY_SIZE(crashpoints); i++) {
		if (!strcmp(cpoint_name, crashpoints[i].name))
		crashpoint = &crashpoints[i];
		}

		/* Refuse unknown crashpoints. */
		if (!crashpoint) {
		pr_err("Invalid crashpoint %s\n", cpoint_name);
		return -EINVAL;
		}
		}

		#ifdef CONFIG_KPROBES
		/* Set crash count. */
		crash_count = cpoint_count;
		#endif

		/* Handle test-specific initialization. */
		lkdtm_bugs_init(&recur_count);
		lkdtm_perms_init();
		lkdtm_usercopy_init();

		/* Register debugfs interface */
		lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
		if (!lkdtm_debugfs_root) {
		pr_err("creating root dir failed\n");
		return -ENODEV;
		}

		/* Install debugfs trigger files. */
		for (i = 0; i < ARRAY_SIZE(crashpoints); i++) {
		struct crashpoint *cur = &crashpoints[i];
		struct dentry *de;

		de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
		cur, &cur->fops);
		if (de == NULL) {
		pr_err("could not create crashpoint %s\n", cur->name);
		goto out_err;
		}
		}

		/* Install crashpoint if one was selected. */
		if (crashpoint) {
		ret = lkdtm_register_cpoint(crashpoint, crashtype);
		if (ret < 0) {
		pr_info("Invalid crashpoint %s\n", crashpoint->name);
		goto out_err;
		}
		pr_info("Crash point %s of type %s registered\n",
		crashpoint->name, cpoint_type);
		} else {
		pr_info("No crash points registered, enable through debugfs\n");
		}

		return 0;

		out_err:
		debugfs_remove_recursive(lkdtm_debugfs_root);
		return ret;
		}

		static void __exit lkdtm_module_exit(void)
		{
		debugfs_remove_recursive(lkdtm_debugfs_root);

		/* Handle test-specific clean-up. */
		lkdtm_usercopy_exit();

		if (lkdtm_kprobe != NULL)
		unregister_kprobe(lkdtm_kprobe);

		pr_info("Crash point unregistered\n");
		}

		module_init(lkdtm_module_init);
		module_exit(lkdtm_module_exit);

		MODULE_LICENSE("GPL");
		MODULE_DESCRIPTION("Kernel crash testing module");