From: Baoquan He <baoquan.he@linux.dev>
To: "Lukas Wunner" <lukas@wunner.de>,
"Jan Sebastian Götte" <contact@jaseg.de>
Cc: "Jan Sebastian Götte" <linux@jaseg.de>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Mike Rapoport" <rppt@kernel.org>,
"Pasha Tatashin" <pasha.tatashin@soleen.com>,
"Pratyush Yadav" <pratyush@kernel.org>,
"Dave Young" <ruirui.yang@linux.dev>,
"Catalin Marinas" <catalin.marinas@arm.com>,
"Will Deacon" <will@kernel.org>,
"David Howells" <dhowells@redhat.com>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Jonathan Corbet" <corbet@lwn.net>,
"Shuah Khan" <skhan@linuxfoundation.org>,
"Paul Moore" <paul@paul-moore.com>,
"James Morris" <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
"Ignat Korchagin" <ignat@linux.win>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
"Keith Busch" <kbusch@kernel.org>, "Jens Axboe" <axboe@kernel.dk>,
"Christoph Hellwig" <hch@lst.de>,
"Sagi Grimberg" <sagi@grimberg.me>,
"Trond Myklebust" <trondmy@kernel.org>,
"Anna Schumaker" <anna@kernel.org>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"James Bottomley" <James.Bottomley@hansenpartnership.com>,
"Marc Dionne" <marc.dionne@auristor.com>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Simon Horman" <horms@kernel.org>,
"Eric Biggers" <ebiggers@kernel.org>,
"Theodore Y. Ts'o" <tytso@mit.edu>,
"Jaegeuk Kim" <jaegeuk@kernel.org>,
"Alexander Viro" <viro@zeniv.linux.org.uk>,
"Christian Brauner" <brauner@kernel.org>,
"Jan Kara" <jack@suse.cz>, "Alasdair Kergon" <agk@redhat.com>,
"Mike Snitzer" <snitzer@kernel.org>,
"Mikulas Patocka" <mpatocka@redhat.com>,
"Benjamin Marzinski" <bmarzins@redhat.com>,
kexec@lists.infradead.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org,
keyrings@vger.kernel.org, linux-doc@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-crypto@vger.kernel.org, linux-nvme@lists.infradead.org,
linux-nfs@vger.kernel.org, linux-integrity@vger.kernel.org,
linux-afs@lists.infradead.org, netdev@vger.kernel.org,
linux-fscrypt@vger.kernel.org, linux-fsdevel@vger.kernel.org,
dm-devel@lists.linux.dev
Subject: Re: [PATCH v2 01/13] kexec: add CRASH_WIPE_SECRETS to wipe secrets before kdump
Date: Mon, 17 Aug 2026 15:38:53 +0800 [thread overview]
Message-ID: <aoK6jXA-tF9qfKOZ@MiWiFi-R3L-srv> (raw)
In-Reply-To: <aoGpcczo5GkBsPwt@wunner.de>
On 08/16/26 at 02:13pm, Lukas Wunner wrote:
> On Wed, Aug 12, 2026 at 12:08:39PM +0200, Jan Sebastian Götte wrote:
> > I can imagine one alternative way to approach this, tell me what you think:
> > Instead of registering wipe handlers that memzero places on panic, I could
> > put an optional registry of (addr, len) descriptors into crashkernel memory
> > that the original kernel populates with the PAs of buffers to clear ahead of
> > time. Then the kdump kernel could do the actual memzero. This would remove
> > all code from the actual kdump path here. The registry could be made
> > per-core to avoid locks.
Since there are a lot of security expert in CC, I am wondering what's
the risk if we wipe secrets during dumping. System is located in
user's place, and vmcore is dumped and collected in user's place. If we
filter out secrets memory when we dumping, what could be leaked out?
>
> Or create a dedicated mempool from which all sensitive data is allocated,
> then call mempool_free_bulk() on kexec to poison everything in that pool?
>
> Thanks,
>
> Lukas
next prev parent reply other threads:[~2026-08-17 7:39 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-11 17:52 [PATCH v2 00/13] CRASH_WIPE_SECRETS: Wipe secrets before kdump (was: CRASH_ZEROIZE) Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 01/13] kexec: add CRASH_WIPE_SECRETS to wipe secrets before kdump Jan Sebastian Götte
2026-08-12 9:30 ` Baoquan He
2026-08-12 10:08 ` Jan Sebastian Götte
2026-08-16 12:13 ` Lukas Wunner
2026-08-17 7:38 ` Baoquan He [this message]
2026-08-17 8:25 ` Baoquan He
2026-08-11 17:52 ` [PATCH v2 02/13] crash-core: Flush caches on CRASH_WIPE_SECRETS Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 03/13] arm64/mm: add set_direct_map_default_nosplit() Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 04/13] mm/secretmem: wipe secret pages before kdump Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 05/13] security/keys: wipe key payloads " Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 06/13] security/keys: implement wipe op for user-type keys Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 07/13] security/keys: implement wipe op for big_key Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 08/13] security/keys: implement wipe op for trusted and encrypted keys Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 09/13] security/keys: implement wipe op for asymmetric keys Jan Sebastian Götte
2026-08-11 17:52 ` [PATCH v2 10/13] rxrpc: implement wipe op for rxrpc keys Jan Sebastian Götte
2026-08-11 17:53 ` [PATCH v2 11/13] fscrypt: wipe master keys before kdump Jan Sebastian Götte
2026-08-11 17:53 ` [PATCH v2 12/13] crypto: api - wipe tfm contexts " Jan Sebastian Götte
2026-08-11 17:53 ` [PATCH v2 13/13] dm crypt: wipe key material " Jan Sebastian Götte
2026-08-11 20:18 ` Milan Broz
2026-08-12 9:56 ` Jan Sebastian Götte
2026-08-11 18:20 ` [PATCH v2 00/13] CRASH_WIPE_SECRETS: Wipe secrets before kdump (was: CRASH_ZEROIZE) Eric Biggers
2026-08-11 19:38 ` Jan Sebastian Götte
2026-08-11 20:41 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aoK6jXA-tF9qfKOZ@MiWiFi-R3L-srv \
--to=baoquan.he@linux.dev \
--cc=James.Bottomley@hansenpartnership.com \
--cc=agk@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=anna@kernel.org \
--cc=axboe@kernel.dk \
--cc=bmarzins@redhat.com \
--cc=brauner@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=contact@jaseg.de \
--cc=corbet@lwn.net \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=dm-devel@lists.linux.dev \
--cc=ebiggers@kernel.org \
--cc=edumazet@google.com \
--cc=hch@lst.de \
--cc=herbert@gondor.apana.org.au \
--cc=horms@kernel.org \
--cc=ignat@linux.win \
--cc=jack@suse.cz \
--cc=jaegeuk@kernel.org \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=kbusch@kernel.org \
--cc=kexec@lists.infradead.org \
--cc=keyrings@vger.kernel.org \
--cc=kuba@kernel.org \
--cc=linux-afs@lists.infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux@jaseg.de \
--cc=lukas@wunner.de \
--cc=marc.dionne@auristor.com \
--cc=mpatocka@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pasha.tatashin@soleen.com \
--cc=paul@paul-moore.com \
--cc=pratyush@kernel.org \
--cc=rppt@kernel.org \
--cc=ruirui.yang@linux.dev \
--cc=sagi@grimberg.me \
--cc=serge@hallyn.com \
--cc=skhan@linuxfoundation.org \
--cc=snitzer@kernel.org \
--cc=trondmy@kernel.org \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
--cc=will@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox