Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932370AbcJGS1I (ORCPT ); Fri, 7 Oct 2016 14:27:08 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:47554 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932238AbcJGS1E (ORCPT ); Fri, 7 Oct 2016 14:27:04 -0400 Date: Fri, 7 Oct 2016 20:26:43 +0200 From: Willy Tarreau To: Kees Cook Cc: Linus Torvalds , Paul Gortmaker , Johannes Weiner , Andrew Morton , Antonio SJ Musumeci , Miklos Szeredi , Linux Kernel Mailing List , stable Subject: Re: BUG_ON() in workingset_node_shadows_dec() triggers Message-ID: <20161007182643.GA10538@1wt.eu> References: <20161007054824.GA9917@1wt.eu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1335 Lines: 27 Hi Kees, On Fri, Oct 07, 2016 at 10:33:33AM -0700, Kees Cook wrote: > I'll quit debating how to change things, but I'll just try to point > out that the "stop execution" logic, currently, is not an accident. > Without CONFIG_BUG, BUG is defined as "do {} while (1)", and without > CONFIG_HAVE_ARCH_BUG, BUG is defined as "printk(...); panic(...);". I think we're all convinced about this *initial* intent. However among the 3197 BUG() and 9594 BUG_ON() that are present in v4.8, how many should *really* be of them ? I'm seeing that during 4.8 development cycle alone, we managed to add 81 BUG() and 55 BUG_ON(). I doubt we found so many valid reasons to kill the system. 38 of them were added to drivers/. The problem is that this "style" has accumulated over the years. We only had 1739 BUG() and 1801 BUG_ON() in 2.6.12. So we roughly multiplied that by 4 in 11 years. The current trend seems to actually be to remove some of them, 3 were removed from lib/, 4 from include/, 29 removed from fs/, one removed from mm/ but two added to kernel/ and 3 other ones to net/. Maybe changing only kernel/ and mm/'s BUG() occurrences to something like "I_KNOW_I_WILL_BE_BLAMED_FOR_THIS_BUG()" and letting them kill until they're properly audited, and leaving the other ones non-fatal could be a reasonable tradeoff to start with ? Willy