linux-kernel - RE: [RFC][PATCH v2 2/3] Hold multiple logs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Jul 2012 20:54:59 +0000
From:	"Luck, Tony" <tony.luck@...el.com>
To:	Seiji Aguchi <seiji.aguchi@....com>,
	Matthew Garrett <mjg@...hat.com>
CC:	"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"mikew@...gle.com" <mikew@...gle.com>,
	"dle-develop@...ts.sourceforge.net" 
	<dle-develop@...ts.sourceforge.net>,
	Satoru Moriya <satoru.moriya@....com>,
	"dzickus@...hat.com" <dzickus@...hat.com>
Subject: RE: [RFC][PATCH v2 2/3] Hold multiple logs

> So, we don't need to introduce a overwriting policy.
> I will make a patch using QueryVariableInfo and just writing multiple logs.

I don't think that's what Matthew said.

Here's the bad scenario he envisions:

System is running. It has an OOPs, which gets logged by pstore, and the system carries on running.

The new daemon that we said we needed earlier in this e-mail thread finds the entry in pstore and
copies it to some place in /var/log and removes the pstore entry - causing pstore to ask EFI (or ERST)
backend to erase the record. Firmware does the erase, but doesn't put the space back into the
free pool for use.

Repeat with more OOPs until all the EFI (or ERST) space has been allocated and then lost into
firmware limbo waiting for a reset.

Now we panic. Pstore asks EFI "Do you have any space?" EFI replies "No". Pstore can't even overwrite
one of the old OOPs records ... because it thinks they have all been erased. So we lose the panic
log.

-Tony
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/