On 3/18/21 6:48 AM, Kees Cook wrote: > On Tue, Mar 09, 2021 at 07:18:32PM +0100, Vlastimil Babka wrote: >> On 3/9/21 7:14 PM, Georgi Djakov wrote: >> > Hi Vlastimil, >> > >> > Thanks for the comment! >> > >> > On 3/9/21 17:09, Vlastimil Babka wrote: >> >> On 3/9/21 2:47 PM, Georgi Djakov wrote: >> >>> Being able to stop the system immediately when a memory corruption >> >>> is detected is crucial to finding the source of it. This is very >> >>> useful when the memory can be inspected with kdump or other tools. >> >> >> >> Is this in some testing scenarios where you would also use e.g. panic_on_warn? >> >> We could hook to that. If not, we could introduce a new >> >> panic_on_memory_corruption that would apply also for debug_pagealloc and whatnot? >> > >> > I would prefer that we not tie it with panic_on_warn - there might be lots of >> > new code in multiple subsystems, so hitting some WARNing while testing is not >> > something unexpected. >> > >> > Introducing an additional panic_on_memory_corruption would work, but i noticed >> > that we already have slub_debug and thought to re-use that. But indeed, аdding >> > an option to panic in for example bad_page() sounds also useful, if that's what >> > you suggest. >> >> Yes, that would be another example. >> Also CCing Kees for input, as besides the "kdump ASAP for debugging" case, I can >> imagine security hardening folks could be interested in the "somebody might have >> just failed to pwn the kernel, better panic than let them continue" angle. But >> I'm naive wrt security, so it might be a stupid idea :) > > I've really wanted such things, but Linus has been pretty adamant about > not wanting to provide new "panic" paths (or even BUG usage[1]). It > seems that panic_on_warn remains the way to get this behavior, > with the understanding that WARN should only be produced on > expected-to-be-impossible situations[1]. > > Hitting a WARN while testing should result in either finding and fixing > a real bug, or removing the WARN in favor of pr_warn(). :) I was going to suggest adding a panic_on_taint parameter... but turns out it was already added last year! And various memory corruption detections already use TAINT_BAD_PAGE, including SLUB. If anything's missing an add_taint() it can be added, and with the parameter you should get what you want. > -Kees > > [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#bug-and-bug-on >
