From: Kees Cook <keescook@chromium.org>
To: Petr Mladek <pmladek@suse.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>,
Alexander Popov <alex.popov@linux.com>,
Jonathan Corbet <corbet@lwn.net>,
Andrew Morton <akpm@linux-foundation.org>,
Thomas Gleixner <tglx@linutronix.de>,
Peter Zijlstra <peterz@infradead.org>,
Joerg Roedel <jroedel@suse.de>,
Maciej Rozycki <macro@orcam.me.uk>,
Muchun Song <songmuchun@bytedance.com>,
Viresh Kumar <viresh.kumar@linaro.org>,
Robin Murphy <robin.murphy@arm.com>,
Randy Dunlap <rdunlap@infradead.org>,
Lu Baolu <baolu.lu@linux.intel.com>,
Luis Chamberlain <mcgrof@kernel.org>, Wei Liu <wl@xen.org>,
John Ogness <john.ogness@linutronix.de>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Alexey Kardashevskiy <aik@ozlabs.ru>,
Christophe Leroy <christophe.leroy@csgroup.eu>,
Jann Horn <jannh@google.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Mark Rutland <mark.rutland@arm.com>,
Andy Lutomirski <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Steven Rostedt <rostedt@goodmis.org>,
Thomas Garnier <thgarnie@google.com>,
Will Deacon <will.deacon@arm.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Laura Abbott <labbott@redhat.com>,
David S Miller <davem@davemloft.net>,
Borislav Petkov <bp@alien8.de>,
kernel-hardening@lists.openwall.com,
linux-hardening@vger.kernel.org, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org, notify@kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [PATCH] Introduce the pkill_on_warn boot parameter
Date: Thu, 30 Sep 2021 11:28:20 -0700 [thread overview]
Message-ID: <202109301121.7644668F3F@keescook> (raw)
In-Reply-To: <YVWAPXSzFNbHz6+U@alley>
On Thu, Sep 30, 2021 at 11:15:41AM +0200, Petr Mladek wrote:
> On Wed 2021-09-29 12:49:24, Paul E. McKenney wrote:
> > On Wed, Sep 29, 2021 at 10:01:33PM +0300, Alexander Popov wrote:
> > > On 29.09.2021 21:58, Alexander Popov wrote:
> > > > Currently, the Linux kernel provides two types of reaction to kernel
> > > > warnings:
> > > > 1. Do nothing (by default),
> > > > 2. Call panic() if panic_on_warn is set. That's a very strong reaction,
> > > > so panic_on_warn is usually disabled on production systems.
>
> Honestly, I am not sure if panic_on_warn() or the new pkill_on_warn()
> work as expected. I wonder who uses it in practice and what is
> the experience.
panic_on_warn() gets used by folks with paranoid security concerns.
> The problem is that many developers do not know about this behavior.
> They use WARN() when they are lazy to write more useful message or when
> they want to see all the provided details: task, registry, backtrace.
The documentation[1] on this hopefully clarifies the situation:
Note that the WARN()-family should only be used for “expected to be
unreachable” situations. If you want to warn about “reachable but
undesirable” situations, please use the pr_warn()-family of functions.
System owners may have set the panic_on_warn sysctl, to make sure their
systems do not continue running in the face of “unreachable” conditions.
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#bug-and-bug-on
> Also it is inconsistent with pr_warn() behavior. Why a single line
> warning would be innocent and full info WARN() cause panic/pkill?
Because pr_warn() is intended for system admins. WARN() is for
developers and should not be reachable through any known path.
> What about pr_err(), pr_crit(), pr_alert(), pr_emerg()? They inform
> about even more serious problems. Why a warning should cause panic/pkill
> while an alert message is just printed?
Additionally, pr_*() don't include stack traces, etc. WARN() is for
situations that should never happen. pr_warn() is about undesirable but
reachable states.
For example:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d4689846881d160a4d12a514e991a740bcb5d65a
> It somehow reminds me the saga with %pK. We were not able to teach
> developers to use it correctly for years and ended with hashed
> pointers.
And this was pointed out when %pK was introduced, but Linus couldn't be
convinced. He changed his mind, thankfully.
--
Kees Cook
next prev parent reply other threads:[~2021-09-30 18:28 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-29 18:58 [PATCH] Introduce the pkill_on_warn boot parameter Alexander Popov
2021-09-29 19:01 ` Alexander Popov
2021-09-29 19:49 ` Paul E. McKenney
2021-09-30 9:15 ` Petr Mladek
2021-09-30 15:05 ` Alexander Popov
2021-10-01 12:23 ` Petr Mladek
2021-09-30 16:59 ` Steven Rostedt
2021-10-01 12:09 ` Petr Mladek
2021-09-30 18:28 ` Kees Cook [this message]
2021-10-01 19:59 ` Linus Torvalds
2021-10-02 11:41 ` Alexander Popov
2021-10-02 12:13 ` Steven Rostedt
2021-10-02 16:33 ` Alexander Popov
2021-10-02 16:52 ` Linus Torvalds
2021-10-02 21:05 ` Alexander Popov
2021-10-05 19:48 ` Eric W. Biederman
2021-10-06 14:56 ` Alexander Popov
2021-10-22 17:30 ` Alexander Popov
2022-07-27 16:17 ` Alexey Khoroshilov
2022-07-27 16:30 ` Jann Horn
2022-07-27 16:43 ` Alexey Khoroshilov
2022-07-27 16:42 ` Linus Torvalds
2022-07-27 17:47 ` Alexey Khoroshilov
2021-09-29 23:31 ` Andrew Morton
2021-09-30 18:27 ` Alexander Popov
2021-09-30 18:36 ` Kees Cook
2021-09-29 19:03 ` Dave Hansen
2021-09-29 19:47 ` Peter Zijlstra
2021-09-29 20:06 ` Kees Cook
2021-09-30 13:55 ` Alexander Popov
2021-09-30 18:20 ` Kees Cook
2021-10-02 18:04 ` Al Viro
2021-10-02 18:31 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202109301121.7644668F3F@keescook \
--to=keescook@chromium.org \
--cc=aik@ozlabs.ru \
--cc=akpm@linux-foundation.org \
--cc=alex.popov@linux.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=ard.biesheuvel@linaro.org \
--cc=baolu.lu@linux.intel.com \
--cc=bp@alien8.de \
--cc=christophe.leroy@csgroup.eu \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=john.ogness@linutronix.de \
--cc=jroedel@suse.de \
--cc=kernel-hardening@lists.openwall.com \
--cc=labbott@redhat.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=macro@orcam.me.uk \
--cc=mark.rutland@arm.com \
--cc=mcgrof@kernel.org \
--cc=notify@kernel.org \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=pmladek@suse.com \
--cc=rdunlap@infradead.org \
--cc=robin.murphy@arm.com \
--cc=rostedt@goodmis.org \
--cc=songmuchun@bytedance.com \
--cc=tglx@linutronix.de \
--cc=thgarnie@google.com \
--cc=torvalds@linux-foundation.org \
--cc=viresh.kumar@linaro.org \
--cc=will.deacon@arm.com \
--cc=wl@xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.