linux-kernel - Re: [PATCH 1/1] mm: sysctl: add panic_on_inconsistent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Feb 2020 15:08:30 +0100
From:   Christian Borntraeger <borntraeger@...ibm.com>
To:     Qian Cai <cai@....pw>, Grzegorz Halat <ghalat@...hat.com>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux-MM <linux-mm@...ck.org>, linux-fsdevel@...r.kernel.org,
        linux-doc@...r.kernel.org, ssaner@...hat.com, atomlin@...hat.com,
        oleksandr@...hat.com, vbendel@...hat.com, kirill@...temov.name,
        khlebnikov@...dex-team.ru,
        Andrew Morton <akpm@...ux-foundation.org>,
        Iurii Zaikin <yzaikin@...gle.com>,
        Kees Cook <keescook@...omium.org>,
        Luis Chamberlain <mcgrof@...nel.org>,
        Jonathan Corbet <corbet@....net>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Subject: Re: [PATCH 1/1] mm: sysctl: add panic_on_inconsistent_mm sysctl



On 29.01.20 19:39, Qian Cai wrote:
> 
> 
>> On Jan 29, 2020, at 1:08 PM, Grzegorz Halat <ghalat@...hat.com> wrote:
>>
>> Memory management subsystem performs various checks at runtime,
>> if an inconsistency is detected then such event is being logged and kernel
>> continues to run. While debugging such problems it is helpful to collect
>> memory dump as early as possible. Currently, there is no easy way to panic
>> kernel when such error is detected.
>>
>> It was proposed[1] to panic the kernel if panic_on_oops is set but this
>> approach was not accepted. One of alternative proposals was introduction of
>> a new sysctl.
>>
>> Add a new sysctl - panic_on_inconsistent_mm. If the sysctl is set then the
>> kernel will be crashed when an inconsistency is detected by memory
>> management. This currently means panic when bad page or bad PTE
>> is detected(this may be extended to other places in MM).
>>
>> Another use case of this sysctl may be in security-wise environments,
>> it may be more desired to crash machine than continue to run with
>> potentially damaged data structures.
> 
> It is annoying that I have to repeat my feedback, but I don’t know why
> admins want to enable this by allowing normal users to crash the systems
> more easily through recoverable MM bugs where I am sure we have plenty.
> How does that improve the security?

There are cases where data corruption is a no-go, while "one node going down" 
is acceptable.
And then there is also the case for payed service providers that often need
a dump at the time of the problem to understand rare issues.

So I DO see value in such a thing. We should just piggy-back on panic_on_warn
I guess.