linux-kernel - [RFC][PATCH] printk: increase devkmsg write() ratelimit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 18 Dec 2018 18:18:42 +0900
From:   Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
To:     Petr Mladek <pmladek@...e.com>,
        Steven Rostedt <rostedt@...dmis.org>
Cc:     Borislav Petkov <bp@...en8.de>,
        Peter Zijlstra <peterz@...radead.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
Subject: [RFC][PATCH] printk: increase devkmsg write() ratelimit

	Hello,
	
	RFC

A painful subject:

I just noticed that stock systemd (no systemd debugging enabled) on my
x86 box write()-s during shutdown to devkmsg more than before, so old
devkmsg ratelimits do not apply:

$ sudo journalctl -n 40000 -f | grep "kernel: printk: systemd-shutdow"
 kernel: printk: systemd-shutdow: 35 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 31 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 35 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 36 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 36 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 36 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 36 output lines suppressed due to ratelimiting
 kernel: printk: systemd-shutdow: 35 output lines suppressed due to ratelimiting

I know that there is a "kernel.printk_devkmsg" interface; do we
expect every systemd-enabled distro to find that out and to tweak
kernel.printk_devkmsg or shall we change the default devkmsg
ratelimit instead?


=====================================================================

Every time I reboot my systemd x86_64 box:

kernel: printk: systemd-shutdow: 36 output lines suppressed due to ratelimiting

Apparently, the default ratelimit - 10 messages max, 5 * HZ
interval - is a bit too restrictive these days, can't help
it; so increase it to "50 messages, same interval" (which is
not awfully a lot).

Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
---
 kernel/printk/printk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 84e54250840a..0ed54f90f208 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -998,7 +998,8 @@ static int devkmsg_open(struct inode *inode, struct file *file)
 	if (!user)
 		return -ENOMEM;
 
-	ratelimit_default_init(&user->rs);
+	ratelimit_state_init(&user->rs, DEFAULT_RATELIMIT_INTERVAL,
+					5 * DEFAULT_RATELIMIT_BURST);
 	ratelimit_set_flags(&user->rs, RATELIMIT_MSG_ON_RELEASE);
 
 	mutex_init(&user->lock);
-- 
2.20.1