linux-kernel - Re: [PATCH 1/3] ring-buffer: Add uname to match criteria for persistent ring buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241217140153.22ac28b0@gandalf.local.home>
Date: Tue, 17 Dec 2024 14:01:53 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org, Masami
 Hiramatsu <mhiramat@...nel.org>, Mark Rutland <mark.rutland@....com>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, Andrew Morton
 <akpm@...ux-foundation.org>, stable@...r.kernel.org
Subject: Re: [PATCH 1/3] ring-buffer: Add uname to match criteria for
 persistent ring buffer

On Tue, 17 Dec 2024 10:42:47 -0800
Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> Really. This is literally what I started the whole original complaint
> about. Go back to my original email, and try to understand the
> original issue. Let me quote the really relevant part of that email
> again:
> 
>   This stuff is full of crazy special cases for things that should never
>   be done in the first place.

To my defense, all of ftrace (function tracing, live kernel patching, etc)
came from trying to do crazy special cases. The TRACE_EVENT() macro being
another one ;-)

> 
> Note - and really INTERNALIZE - that "for stuff that should never be
> done in the first place".
> 
> You started with the wrong design. Then you keep hacking it up, and
> the hacks just get wilder and crazier as you notice there are more
> special cases.
> 
> This is now getting to the point where I'm considering just ripping
> out the whole boot-time previous kernel buffer crap because you seem
> to have turned an interesting idea into just a morass of problems.
> 
> Your choice: get rid of the crazy, or have me rip it out.
> 

Point taken. And for my work use case, I can keep the ring buffer as is and
do most the work in user space. I did these "hacks" for those that do not
use trace-cmd and still use the tracefs file system directly (like a lot of
the embedded folks).

But instead, I'll replace the text/data_deltas with a kaslr offset (it will
only be exported if the trace contains data from a previous kernel so not
to export the current kaslr offset).

Then, on our production systems, we'll save the meta data of the events we
enable (this can include module events as well as dynamic events) and after
a crash, we'll extract the data along with the saved data stored on disk,
and be able to recreate the entire trace.

I'll only push patch 3 without the %s pointer update.

-- Steve