linux-kernel - Re: [PATCH v3] x86/mce: Set PG_hwpoison page flag to avoid the capture kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <759ccb97-cf5a-4787-b699-27551d5d2865@intel.com>
Date:   Tue, 17 Oct 2023 09:05:36 +0800
From:   Zhiquan Li <zhiquan1.li@...el.com>
To:     Borislav Petkov <bp@...en8.de>
CC:     "Luck, Tony" <tony.luck@...el.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "linux-edac@...r.kernel.org" <linux-edac@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "patches@...ts.linux.dev" <patches@...ts.linux.dev>,
        "mingo@...nel.org" <mingo@...nel.org>,
        "naoya.horiguchi@....com" <naoya.horiguchi@....com>
Subject: Re: [PATCH v3] x86/mce: Set PG_hwpoison page flag to avoid the
 capture kernel panic

On 2023/10/16 17:11, Borislav Petkov wrote:
>> For some MCE fatal error cases, the kernel might call
>> mce_panic() to terminate the production kernel directly, thus there is
>> no opportunity to queue a task for calling memory_failure() which will
>> try to make the kernel survive via memory failure handling.
> You can't "make the kernel survive" if the error has been deemed
> critical. That's mce_severity()'s job. If it grades the error's severity
> wrongly and memory_failure() should run after all, then this is
> a different story.
> 

I understand what you mean.  Looks I didn't express myself well on this
point and caused ambiguity.  Maybe removing the attributive clause would
make it brief and clear? Such as,

	For some MCE fatal error cases, the kernel might call
	mce_panic() to terminate the production kernel directly, there
	is no opportunity to queue a task for calling memory_failure().

Or do you have other better suggestions? Thanks.


>> @@ -286,6 +287,17 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)
>>  	if (!fake_panic) {
>>  		if (panic_timeout == 0)
>>  			panic_timeout = mca_cfg.panic_timeout;
> This whole thing...
> 
>> +		/*
>> +		 * Kdump can exclude the HWPoison page to avoid touching the error
>> +		 * page again, the prerequisite is that the PG_hwpoison page flag is
>> +		 * set.  However, for some MCE fatal error cases, there is no
>> +		 * opportunity to queue a task for calling memory_failure(), and as a
>> +		 * result, the capture kernel panics.  So mark the page as HWPoison
>> +		 * before kernel panic() for MCE.
>> +		 */
>> +		p = pfn_to_online_page(final->addr >> PAGE_SHIFT);
>> +		if (final && (final->status & MCI_STATUS_ADDRV) && p)
>> +			SetPageHWPoison(p);
> ... needs to be inside:
> 
> 	if (kexec_crash_loaded() {
> 		...
> 	}
> 
> otherwise it'll be useless work on the panic path.

Good idea! The condition makes it more robust.  I'll validate it and
send V4.

Best Regards,
Zhiquan