Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932354AbcJEVqV (ORCPT ); Wed, 5 Oct 2016 17:46:21 -0400 Received: from mail-oi0-f47.google.com ([209.85.218.47]:33309 "EHLO mail-oi0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752829AbcJEVqT (ORCPT ); Wed, 5 Oct 2016 17:46:19 -0400 MIME-Version: 1.0 In-Reply-To: References: <20161005054407.GC7297@1wt.eu> <20161005190604.GA8116@1wt.eu> From: Linus Torvalds Date: Wed, 5 Oct 2016 14:46:17 -0700 X-Google-Sender-Auth: tvK0esLaTwppQaY6e_5kEHKxPlA Message-ID: Subject: Re: BUG_ON() in workingset_node_shadows_dec() triggers To: Kees Cook Cc: Willy Tarreau , Paul Gortmaker , Johannes Weiner , Andrew Morton , Antonio SJ Musumeci , Miklos Szeredi , Linux Kernel Mailing List , stable Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1052 Lines: 21 On Wed, Oct 5, 2016 at 2:14 PM, Kees Cook wrote: > Now, it can be argued that killing the process part should be > configurable and that the code should be written to handle a WARN and > clean up and error out nicely. But I still want to retain the "kill > the process immediately" behavior in some capacity. If "some capacity" is "can't do user space accesses", we could easily force a SIGKILL of the current process. It won't die immediately in the kernel, but it won't be returning to user space either. The problem with the immediate kill is that it can be in interrupt context, or just holding arbitrary locks. And it's hard to even tell dynamically (sometimes you can see it: with preemption enabled you can tell "am I in a non-preempt area", for example, but it ends up depending on config options). And *if* we make BUG() actually do something sane (non-trapping), we can easily make it be generic, not arch-specific. In fact, I'd implement it by just adding a "handle_bug()" in kernel/panic.c... Linus