linux-kernel - Re: [RFC v4] debug: prevent entering debug mode on panic/exception.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 06 Jan 2015 15:25:51 +0000
From:	Daniel Thompson <daniel.thompson@...aro.org>
To:	Andrew Morton <akpm@...ux-foundation.org>,
	Kiran Raparthy <kiran.kumar@...aro.org>
CC:	linux-kernel@...r.kernel.org, Colin Cross <ccross@...roid.com>,
	Jason Wessel <jason.wessel@...driver.com>,
	kgdb-bugreport@...ts.sourceforge.net,
	Android Kernel Team <kernel-team@...roid.com>,
	John Stultz <john.stultz@...aro.org>,
	Sumit Semwal <sumit.semwal@...aro.org>
Subject: Re: [RFC v4] debug: prevent entering debug mode on panic/exception.

On 06/01/15 00:14, Andrew Morton wrote:
> On Tue, 23 Dec 2014 18:08:29 +0530 Kiran Raparthy <kiran.kumar@...aro.org> wrote:
> 
>> From: Colin Cross <ccross@...roid.com>
>>
>> debug: prevent entering debug mode on panic/exception.
>>
>> On non-developer devices, kgdb prevents the device from rebooting
>> after a panic.
>>
>> Incase of panics and exceptions, to allow the device to reboot, prevent
>> entering debug mode to avoid getting stuck waiting for the user to interact
>> with debugger.
>>
>> To avoid entering the debugger on panic/exception without any extra
>> configuration, panic_timeout is being used which can be set via
>> /proc/sys/kernel/panic at run time and CONFIG_PANIC_TIMEOUT sets the default
>> value.
>>
>> ...
>>
> 
> hm.  Why overload the meaning of panic_timeout in this fashion?  If
> someone is using kgdb and has panic_timeout set, they'll get quiet a
> surprise.

Will they?

Setting panic_timeout means the user explicitly requested that the
machine try to perform an unattended reboot after a panic. Wedging in
kgdb during panic on such a system absolutely contradicts the user's
request to have an automated reboot.

In this case it is not overloading the meaning... we are simply altering
kgdb to properly honour the existing meaning.

Changing the behaviour for exceptions as well as for panics *might*
maybe veer into overloading but even there, I think we are simply better
reflecting user intent. It is hard to imagine a user that wants
automatic-reboot-on-panic being happy for the kernel to get stuck
overnight just because of an oops.

> Would it be cleaner/clearer to add some new standalone control for
> this?  One which is only present if CONFIG_KGDB.

I don't think it is clearer (although given it was my review that lead
us here that's probably to be expected).

Separating them out simply means an additional gotcha a user must be
aware of if they want automatic reboot *and* kgdb (i.e. two kernel
cmdline arguments must be used that then just one).

> We appear to have forgotten to document panic_timeout.  Sigh.

On the subject of documentation it would be useful to update the kgdb
docs to document the effect of panic_timeout on panic/exception behaviour.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/