linux-kernel - Re: [PATCH v3] fs/coredump: Enable dynamic configuration of max file note size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZjVAJOsC-EtlIXd6@bombadil.infradead.org>
Date: Fri, 3 May 2024 12:51:00 -0700
From: Luis Chamberlain <mcgrof@...nel.org>
To: Allen Pais <apais@...ux.microsoft.com>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org, viro@...iv.linux.org.uk, brauner@...nel.org,
	jack@...e.cz, ebiederm@...ssion.com, keescook@...omium.org,
	j.granados@...sung.com, allen.lkml@...il.com
Subject: Re: [PATCH v3] fs/coredump: Enable dynamic configuration of max file
 note size

Thanks for the cleanups, this is certainly now in the right direction.
Generic long term growth questions below.

On Thu, May 02, 2024 at 11:56:03PM +0000, Allen Pais wrote:
> Why is this being done?
> We have observed that during a crash when there are more than 65k mmaps
> in memory, the existing fixed limit on the size of the ELF notes section
> becomes a bottleneck. The notes section quickly reaches its capacity,

I'm not well versed here on how core dumps associate mmaps to ELF notes
section, can you elaborate? Does each new mmap potentially peg
information on ELF notes section? Where do we standardize on this? Does
it also change depending on any criteria of the mmap?

Depending on the above, we might want to be proactive to get a sense of
when we want to go beyond the new 16 MiB max cap on new mmaps for instance.
How many mmaps can we have anyway too?

> leading to incomplete memory segment information in the resulting coredump.
> This truncation compromises the utility of the coredumps, as crucial
> information about the memory state at the time of the crash might be
> omitted.

  Luis