[PATCH] reboot: halt when power off fails

[PATCH] reboot: halt when power off fails

[Breno Leitao]

The reboot syscall calls do_exit(0) when kernel_power_off() returns.
That happens when no power off handler takes the machine down, since
machine_power_off() returns to its caller on x86, arm, arm64 and sh.

For example, an x86 kernel built with CONFIG_ACPI_REDUCED_HARDWARE_ONLY
cannot power off QEMU's pc and q35 machines. Their FADT is not
hardware-reduced, so acpi_power_off() is still registered. But the
legacy sleep code is compiled out and the FADT has no sleep control
register, so acpi_enter_sleep_state() returns AE_NOT_EXIST.

On x86, arm and arm64, interrupts are disabled by then, and do_exit()
warns. syzbot hit this on a GCE VM:

  ACPI: PM: Preparing to enter system sleep state S5
  kvm: exiting hardware virtualization
  reboot: Power down
  ------------[ cut here ]------------
  irqs_disabled()
  WARNING: kernel/exit.c:930 at do_exit+0x1cf7/0x2ae0 kernel/exit.c:930, CPU#0: init/6193
  CPU: 0 UID: 0 PID: 6193 Comm: init Tainted: G             L      syzkaller #0 PREEMPT(full)
  Call Trace:
   <TASK>
   __do_sys_reboot+0x36e/0x400 kernel/reboot.c:784
   do_syscall_64+0x115/0x840 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

If the caller is init, do_exit() then panics. Exiting does not help
the other callers either: the devices are already shut down, and the
task still holds system_transition_mutex.

Halt instead, as the syscall already does when no power off handler is
registered, and as most other architectures do in machine_power_off().

Use machine_halt() rather than kernel_halt(). kernel_power_off() has
already run the shutdown sequence, and kernel_halt() would call the
reboot notifiers again with interrupts disabled.

Keep the fallback in the syscall. hw_failure_emergency_action_func()
relies on kernel_power_off() returning, so that it can try an
emergency restart.

Fixes: 001c28e57187 ("exit: Detect and fix irq disabled state in oops")
Reported-by: syzbot+8fdf0d8e10bdde1c2e88@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8fdf0d8e10bdde1c2e88
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/all/20250404152006.GF3720@redhat.com/
Link: https://lore.kernel.org/all/20260713062332.21131-1-include@grrlz.net/
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
---
This is my second attempt at fixing this. The first one silenced the
warning in do_exit() pre LLMs:
https://lore.kernel.org/all/20250403-exit-v1-1-8e9266bfc4b7@debian.org/

Bradley Morgan tried twice, first enabling interrupts before do_exit(),
then calling make_task_dead():
https://lore.kernel.org/all/20260712125300.31501-1-include@grrlz.net/
https://lore.kernel.org/all/20260713062332.21131-1-include@grrlz.net/

Tze-nan Wu hit a related init panic during power off:
https://lore.kernel.org/all/20250410143937.1829272-1-Tze-nan.Wu@mediatek.com/

All of these still let the task exit. In those threads Oleg and
Christian said init should not exit on power off at all, so this
version halts instead.
---
 kernel/reboot.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/reboot.c b/kernel/reboot.c
index 9a84401adde5a0..bc71183d4ad870 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -791,6 +791,9 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
 
 	case LINUX_REBOOT_CMD_POWER_OFF:
 		kernel_power_off();
+		pr_emerg("Power off failed: System halted instead\n");
+		/* kernel_power_off() already ran the shutdown, only halt. */
+		machine_halt();
 		do_exit(0);
 		break;
 

---
base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
change-id: 20261110-reboot-make-task-dead-8702e9b29130

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] reboot: halt when power off fails

[Bradley Morgan]

On 10 November 2026 15:24:34 GMT, Breno Leitao <leitao@debian.org> wrote:
>The reboot syscall calls do_exit(0) when kernel_power_off() returns.
>That happens when no power off handler takes the machine down, since
>machine_power_off() returns to its caller on x86, arm, arm64 and sh.
>
>For example, an x86 kernel built with CONFIG_ACPI_REDUCED_HARDWARE_ONLY
>cannot power off QEMU's pc and q35 machines. Their FADT is not
>hardware-reduced, so acpi_power_off() is still registered. But the
>legacy sleep code is compiled out and the FADT has no sleep control
>register, so acpi_enter_sleep_state() returns AE_NOT_EXIST.
>
>On x86, arm and arm64, interrupts are disabled by then, and do_exit()
>warns. syzbot hit this on a GCE VM:
>
>  ACPI: PM: Preparing to enter system sleep state S5
>  kvm: exiting hardware virtualization
>  reboot: Power down
>  ------------[ cut here ]------------
>  irqs_disabled()
>  WARNING: kernel/exit.c:930 at do_exit+0x1cf7/0x2ae0 kernel/exit.c:930, CPU#0: init/6193
>  CPU: 0 UID: 0 PID: 6193 Comm: init Tainted: G             L      syzkaller #0 PREEMPT(full)
>  Call Trace:
>   <TASK>
>   __do_sys_reboot+0x36e/0x400 kernel/reboot.c:784
>   do_syscall_64+0x115/0x840 arch/x86/entry/syscall_64.c:94
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
>   </TASK>
>
>If the caller is init, do_exit() then panics. Exiting does not help
>the other callers either: the devices are already shut down, and the
>task still holds system_transition_mutex.
>
>Halt instead, as the syscall already does when no power off handler is
>registered, and as most other architectures do in machine_power_off().
>
>Use machine_halt() rather than kernel_halt(). kernel_power_off() has
>already run the shutdown sequence, and kernel_halt() would call the
>reboot notifiers again with interrupts disabled.
>
>Keep the fallback in the syscall. hw_failure_emergency_action_func()
>relies on kernel_power_off() returning, so that it can try an
>emergency restart.
>
>Fixes: 001c28e57187 ("exit: Detect and fix irq disabled state in oops")
>Reported-by: syzbot+8fdf0d8e10bdde1c2e88@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=8fdf0d8e10bdde1c2e88
>Suggested-by: Oleg Nesterov <oleg@redhat.com>
>Link: https://lore.kernel.org/all/20250404152006.GF3720@redhat.com/
>Link: https://lore.kernel.org/all/20260713062332.21131-1-include@grrlz.net/
>Cc: stable@vger.kernel.org
>Signed-off-by: Breno Leitao <leitao@debian.org>
>---
>This is my second attempt at fixing this. The first one silenced the
>warning in do_exit() pre LLMs:
>https://lore.kernel.org/all/20250403-exit-v1-1-8e9266bfc4b7@debian.org/
>
>Bradley Morgan tried twice, first enabling interrupts before do_exit(),
>then calling make_task_dead():
>https://lore.kernel.org/all/20260712125300.31501-1-include@grrlz.net/
>https://lore.kernel.org/all/20260713062332.21131-1-include@grrlz.net/
>
>Tze-nan Wu hit a related init panic during power off:
>https://lore.kernel.org/all/20250410143937.1829272-1-Tze-nan.Wu@mediatek.com/
>
>All of these still let the task exit. In those threads Oleg and
>Christian said init should not exit on power off at all, so this
>version halts instead.
>---
> kernel/reboot.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/kernel/reboot.c b/kernel/reboot.c
>index 9a84401adde5a0..bc71183d4ad870 100644
>--- a/kernel/reboot.c
>+++ b/kernel/reboot.c
>@@ -791,6 +791,9 @@ SYSCALL_DEFINE4(reboot, int, magic1, int, magic2, unsigned int, cmd,
> 
> 	case LINUX_REBOOT_CMD_POWER_OFF:
> 		kernel_power_off();
>+		pr_emerg("Power off failed: System halted instead\n");
>+		/* kernel_power_off() already ran the shutdown, only halt. */
>+		machine_halt();

Reviewed-by: Bradley Morgan <bradley.morgan@linux.dev>

Id reckon this would fix it, go test syzbot if you'd wanna be confident :)

> 		do_exit(0);
> 		break;
> 
>
>---
>base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
>base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
>change-id: 20261110-reboot-make-task-dead-8702e9b29130
>
>Best regards,
>--  
>Breno Leitao <leitao@debian.org>
>
>
>

--- Thanks!