[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1580742371.7365.1.camel@lca.pw>
Date: Mon, 03 Feb 2020 10:06:11 -0500
From: Qian Cai <cai@....pw>
To: Christian Borntraeger <borntraeger@...ibm.com>,
Grzegorz Halat <ghalat@...hat.com>
Cc: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Linux-MM <linux-mm@...ck.org>, linux-fsdevel@...r.kernel.org,
linux-doc@...r.kernel.org, ssaner@...hat.com, atomlin@...hat.com,
oleksandr@...hat.com, vbendel@...hat.com, kirill@...temov.name,
khlebnikov@...dex-team.ru,
Andrew Morton <akpm@...ux-foundation.org>,
Iurii Zaikin <yzaikin@...gle.com>,
Kees Cook <keescook@...omium.org>,
Luis Chamberlain <mcgrof@...nel.org>,
Jonathan Corbet <corbet@....net>,
Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Subject: Re: [PATCH 1/1] mm: sysctl: add panic_on_inconsistent_mm sysctl
On Mon, 2020-02-03 at 15:08 +0100, Christian Borntraeger wrote:
>
> On 29.01.20 19:39, Qian Cai wrote:
> >
> >
> > > On Jan 29, 2020, at 1:08 PM, Grzegorz Halat <ghalat@...hat.com> wrote:
> > >
> > > Memory management subsystem performs various checks at runtime,
> > > if an inconsistency is detected then such event is being logged and kernel
> > > continues to run. While debugging such problems it is helpful to collect
> > > memory dump as early as possible. Currently, there is no easy way to panic
> > > kernel when such error is detected.
> > >
> > > It was proposed[1] to panic the kernel if panic_on_oops is set but this
> > > approach was not accepted. One of alternative proposals was introduction of
> > > a new sysctl.
> > >
> > > Add a new sysctl - panic_on_inconsistent_mm. If the sysctl is set then the
> > > kernel will be crashed when an inconsistency is detected by memory
> > > management. This currently means panic when bad page or bad PTE
> > > is detected(this may be extended to other places in MM).
> > >
> > > Another use case of this sysctl may be in security-wise environments,
> > > it may be more desired to crash machine than continue to run with
> > > potentially damaged data structures.
> >
> > It is annoying that I have to repeat my feedback, but I don’t know why
> > admins want to enable this by allowing normal users to crash the systems
> > more easily through recoverable MM bugs where I am sure we have plenty.
> > How does that improve the security?
>
> There are cases where data corruption is a no-go, while "one node going down"
> is acceptable.
> And then there is also the case for payed service providers that often need
> a dump at the time of the problem to understand rare issues.
>
> So I DO see value in such a thing. We should just piggy-back on panic_on_warn
> I guess.
>
Indeed, so change pr_alert() to pr_warn() there then?
Powered by blists - more mailing lists