linux-kernel - Re: [PATCH 1/2 v6] kdump: add the vmcoreinfo documentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <134663991.69764038.1547494607008.JavaMail.zimbra@redhat.com>
Date:   Mon, 14 Jan 2019 14:36:47 -0500 (EST)
From:   Dave Anderson <anderson@...hat.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Kazuhito Hagio <k-hagio@...jp.nec.com>,
        Lianbo Jiang <lijiang@...hat.com>,
        linux-kernel@...r.kernel.org, kexec@...ts.infradead.org,
        tglx@...utronix.de, mingo@...hat.com, x86@...nel.org,
        akpm@...ux-foundation.org, bhe@...hat.com, dyoung@...hat.com,
        linux-doc@...r.kernel.org
Subject: Re: [PATCH 1/2 v6] kdump: add the vmcoreinfo documentation




----- Original Message -----
> On Mon, Jan 14, 2019 at 01:58:32PM -0500, Dave Anderson wrote:
> > Preferably it would be left as-is.  The crash utility has a "crash
> > --osrelease vmcore"
> > option that only looks at the dumpfile header, and just dump the string.
> > With respect
> > to compressed kdumps, crash could alternatively look at the utsname data
> > that is stored
> > in the diskdump_header.utsname field, but with ELF vmcores, there is no
> > such back-up.
> 
> Well, there is:
> 
> 00000000  4f 53 52 45 4c 45 41 53  45 3d 35 2e 30 2e 30 2d |OSRELEASE=5.0.0-|
> 00000010  72 63 32 2b 0a 50 41 47  45 53 49 5a 45 3d 34 30 |rc2+.PAGESIZE=40|
> 00000020  39 36 0a 53 59 4d 42 4f  4c 28 6d 65 6d 5f 73 65 |96.SYMBOL(mem_se|
> 00000030  63 74 69 6f 6e 29 3d 66  66 66 66 66 66 66 66 38 |ction)=ffffffff8|
> 00000040  34 35 31 61 31 61 38 0a  53 59 4d 42 4f 4c 28 69 |451a1a8.SYMBOL(i|
> 00000050  6e 69 74 5f 75 74 73 5f  6e 73 29 3d 66 66 66 66 |nit_uts_ns)=ffff|
>                                                                          ^^^^
> 00000060  66 66 66 66 38 32 30 31  33 35 34 30 0a 53 59 4d  |ffff82013540
>                                                              ^^^^^^^^^^^^
> 
> This address has it.

There's no reading of the dumpfile's memory involved, and that being the case,
the vmlinux file is not utilized.  That's the whole point of the crash option, i.e.,
taking a vmcore file, and trying to determine what kernel should be used with it:

  $ man crash
  ...
       --osrelease dumpfile
              Display the OSRELEASE vmcoreinfo string from a kdump dumpfile header.
  ...


> 
> > What's the problem with leaving it alone?
> 
> The problem is that I'd like to get all those vmcoreinfo exports under
> control and to not have people frivolously export whatever they feel
> like, for obvious reasons, and to get rid of the duplicate/unused pieces
> being part of vmcoreinfo.

Well, I just don't agree that the OSRELEASE item is "frivolous".  It's been in place,
and depended upon, for many years.

Dave