CODEWITHSUNDEEP
ckernelfedorakernel-module
dexterous
dexterous

Reputation: 6526

How to make the system crash using a faulty kernel module - FC19?

As per my knowledge, the linux kernel is monolithic. It means if any kernel module crashes, the entire system should crash. However, I didn't see the same. Here is my buggy program? Why my machine didn't crash? How can I amend my program to make my system crash?

#include <linux/init.h>
#include <linux/module.h> /** needed by all modules **/
#include <linux/kernel.h>  /** This is for KERN_ALERT **/

MODULE_LICENSE("SJ BSD/GPL");

int t = 100;

static int hello_init(void)
{
  printk(KERN_ALERT "Hello SJ\n");
  t = t *10;
   t = t/0;
   printk(KERN_ALERT "The value of t is %d\n",t);
  return 0;
}

static void hello_exit(void)
{
  printk(KERN_ALERT "Goodbye..SJ\n");
}

module_init(hello_init);
module_exit(hello_exit);

This is the output I get -

# insmod ./hello.ko
Segmentation fault

#uname -a
2.6.32.26-175.fc12.i686.PAE #1 SMP Wed Dec 1 21:45:50 UTC 2010 i686 i686 i386 GNU/Linux

The dmesg tail is 

id: 20883, comm: insmod Tainted: P           (2.6.32.26-175.fc12.i686.PAE #1) OptiPlex 990
EIP: 0060:[<f7e9e02f>] EFLAGS: 00010246 CPU: 4
EIP is at param_init+0x1a/0x27 [param]
EAX: 00000000 EBX: f7e9e0b0 ECX: c0aa8e60 EDX: 00000000
ESI: 00000000 EDI: f7e9e015 EBP: f2d39f84 ESP: f2d39f7c
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process insmod (pid: 20883, ti=f2d38000 task=f6630000 task.ti=f2d38000)
Stack:
 f7e9e079 00000000 f2d39f9c c040305b 00000000 f7e9e0b0 00000000 bfe0ed78
<0> f2d39fac c04716da 09932018 00000000 f2d38000 c040903b 09932018 000169c9
<0> 09932008 00000000 bfe0ed78 bfe0ed98 00000080 0000007b 0000007b 00000000
Call Trace:
 [<c040305b>] ? do_one_initcall+0x51/0x13f
 [<c04716da>] ? sys_init_module+0xac/0x1e2
 [<c040903b>] ? sysenter_do_call+0x12/0x28
Code: 1f 44 00 00 68 66 e0 e9 f7 e8 cf 93 90 c8 58 c9 c3 55 89 e5 0f 1f 44 00 00 ff 35 18 e2 e9 f7 68 79 e0 e9 f7 e8 b4 93 90 c8 31 c0 <c7> 05 00 00 00 00 64 00 00 00 c9 c3 90 04 00 00 00 14 00 00 00 
EIP: [<f7e9e02f>] param_init+0x1a/0x27 [param] SS:ESP 0068:f2d39f7c

I expect the entire system to crash. However, the machine has not crashed or rebooted. It's just that particular module has crashed. I want to make the entire system down. It should be ideally since the kernel is monolithic. Any problem in kernel should shutdown the entire the machine. However, I am not seeing the same. What is the issue? can you please throw some light on it? Is my concept not correct here?

Upvotes: 1

Views: 732

Answers (1)

merlin2011
merlin2011

Reputation: 75545

I used the old way of doing the writing the functions and it reliably crashed my VM's kernel.

The VM is running Red Hat Enterprise Linux Server release 6.3.

#include <linux/module.h>   /* Needed by all modules */
#include <linux/kernel.h>   /* Needed for KERN_INFO */



int t = 100;
int init_module(void)
{
    printk(KERN_ALERT "Hello SJ\n");
    t = t *10;
    t = t/0;
    printk(KERN_ALERT "The value of t is %d\n",t);
}
void cleanup_module(void)
{
}

Based on your update, my best guess is that the insmod tool is compiling and running the functions before inserting them into the kernel, which is why the insmod command itself segfaults. The reason is that your dmesg output suggests that it is Process insmod which has segfaulted. To verify this though, you would have to look at the insmod source code for your system.

An interesting experiment to determine whether insmod is running the module in kernel mode or user mode, would be to put some privileged instruction (such as rdmsr) as inline assembler into the module and see if insmod will choke on that.

Upvotes: 2

Related Questions