linux-kernel - fs/pstore question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMJ=MEdS4+5Un77MU7dPxkOjA7-yAv-1tbt0vbUaZ8n4R_rrBQ@mail.gmail.com>
Date:   Thu, 9 May 2019 10:05:15 +0200
From:   Ronny Meeus <ronny.meeus@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: fs/pstore question

Hello

I'm using the pstore feature to log kernel crashes.

What I observe is that after reboot, always 2 entries are present in the pstore:

ls -l /mnt/pstore
total 0
-r--r--r--    1 root     root         16372 Jan  1 00:00 dmesg-ramoops-0
-r--r--r--    1 root     root         16372 Jan  1 00:00 dmesg-ramoops-1

If I do not delete the entries and force a new crash, only 2 new
entries are available
after the system is online again and the older entries are overwritten.

The reason for this is that the write index is always initialized to 0
during init.
Is this intentional? I would expect that existing entries are kept
until they are explicitly
deleted or the storage is full. In the latter case the oldest entries
can be replaced.

Best regards,
Ronny