linux-kernel - Re: fs/pstore question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMJ=MEcTP1Y_ZE6iqxX-MANGnzGrbzkFUs0TzBHc+KB62aEyqw@mail.gmail.com>
Date:   Mon, 20 May 2019 09:29:57 +0200
From:   Ronny Meeus <ronny.meeus@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: fs/pstore question

Op do 9 mei 2019 10:05 schreef Ronny Meeus <ronny.meeus@...il.com>:
>
> Hello
>
> I'm using the pstore feature to log kernel crashes.
>
> What I observe is that after reboot, always 2 entries are present in the pstore:
>
> ls -l /mnt/pstore
> total 0
> -r--r--r--    1 root     root         16372 Jan  1 00:00 dmesg-ramoops-0
> -r--r--r--    1 root     root         16372 Jan  1 00:00 dmesg-ramoops-1
>
> If I do not delete the entries and force a new crash, only 2 new
> entries are available
> after the system is online again and the older entries are overwritten.
>
> The reason for this is that the write index is always initialized to 0
> during init.
> Is this intentional? I would expect that existing entries are kept
> until they are explicitly
> deleted or the storage is full. In the latter case the oldest entries
> can be replaced.
>
> Best regards,
> Ronny


Any feedback is appreciated.
Thanks