Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A4C6C433F5 for ; Tue, 16 Nov 2021 06:38:22 +0000 (UTC) Received: from vger.kernel.org (unknown [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F37CA6322A for ; Tue, 16 Nov 2021 06:38:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org F37CA6322A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=csgroup.eu Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234453AbhKPGku (ORCPT ); Tue, 16 Nov 2021 01:40:50 -0500 Received: from pegase2.c-s.fr ([93.17.235.10]:44381 "EHLO pegase2.c-s.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234438AbhKPGkd (ORCPT ); Tue, 16 Nov 2021 01:40:33 -0500 Received: from localhost (mailhub3.si.c-s.fr [172.26.127.67]) by localhost (Postfix) with ESMTP id 4Htbvw6xyhz9sSH; Tue, 16 Nov 2021 07:37:32 +0100 (CET) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase2.c-s.fr ([172.26.127.65]) by localhost (pegase2.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YIPFZjdwqqfE; Tue, 16 Nov 2021 07:37:32 +0100 (CET) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase2.c-s.fr (Postfix) with ESMTP id 4Htbvw5wGbz9sSC; Tue, 16 Nov 2021 07:37:32 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id B49D48B77A; Tue, 16 Nov 2021 07:37:32 +0100 (CET) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id EAtlP181_aWQ; Tue, 16 Nov 2021 07:37:32 +0100 (CET) Received: from [192.168.234.8] (unknown [192.168.234.8]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 3DDAF8B763; Tue, 16 Nov 2021 07:37:30 +0100 (CET) Message-ID: <380a8fd0-d7c3-2487-7cd5-e6fc6e7693d9@csgroup.eu> Date: Tue, 16 Nov 2021 07:37:29 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 Subject: Re: [PATCH v2 0/2] Introduce the pkill_on_warn parameter Content-Language: fr-FR To: Steven Rostedt , Lukas Bulwahn Cc: Alexander Popov , Linus Torvalds , Jonathan Corbet , Paul McKenney , Andrew Morton , Thomas Gleixner , Peter Zijlstra , Joerg Roedel , Maciej Rozycki , Muchun Song , Viresh Kumar , Robin Murphy , Randy Dunlap , Lu Baolu , Petr Mladek , Kees Cook , Luis Chamberlain , Wei Liu , John Ogness , Andy Shevchenko , Alexey Kardashevskiy , Jann Horn , Greg Kroah-Hartman , Mark Rutland , Andy Lutomirski , Dave Hansen , Will Deacon , Ard Biesheuvel , Laura Abbott , David S Miller , Borislav Petkov , Arnd Bergmann , Andrew Scull , Marc Zyngier , Jessica Yu , Iurii Zaikin , Rasmus Villemoes , Wang Qing , Mel Gorman , Mauro Carvalho Chehab , Andrew Klychkov , Mathieu Chouquet-Stringer , Daniel Borkmann , Stephen Kitt , Stephen Boyd , Thomas Bogendoerfer , Mike Rapoport , Bjorn Andersson , Kernel Hardening , linux-hardening@vger.kernel.org, "open list:DOCUMENTATION" , linux-arch , Linux Kernel Mailing List , linux-fsdevel , notify@kernel.org, main@lists.elisa.tech, safety-architecture@lists.elisa.tech, devel@lists.elisa.tech, Shuah Khan References: <20211027233215.306111-1-alex.popov@linux.com> <77b79f0c-48f2-16dd-1d00-22f3a1b1f5a6@linux.com> <20211115110649.4f9cb390@gandalf.local.home> From: Christophe Leroy In-Reply-To: <20211115110649.4f9cb390@gandalf.local.home> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Le 15/11/2021 à 17:06, Steven Rostedt a écrit : > On Mon, 15 Nov 2021 14:59:57 +0100 > Lukas Bulwahn wrote: > >> 1. Allow a reasonably configured kernel to boot and run with >> panic_on_warn set. Warnings should only be raised when something is >> not configured as the developers expect it or the kernel is put into a >> state that generally is _unexpected_ and has been exposed little to >> the critical thought of the developer, to testing efforts and use in >> other systems in the wild. Warnings should not be used for something >> informative, which still allows the kernel to continue running in a >> proper way in a generally expected environment. Up to my knowledge, >> there are some kernels in production that run with panic_on_warn; so, >> IMHO, this requirement is generally accepted (we might of course > > To me, WARN*() is the same as BUG*(). If it gets hit, it's a bug in the > kernel and needs to be fixed. I have several WARN*() calls in my code, and > it's all because the algorithms used is expected to prevent the condition > in the warning from happening. If the warning triggers, it means either that > the algorithm is wrong or my assumption about the algorithm is wrong. In > either case, the kernel needs to be updated. All my tests fail if a WARN*() > gets hit (anywhere in the kernel, not just my own). > > After reading all the replies and thinking about this more, I find the > pkill_on_warning actually worse than not doing anything. If you are > concerned about exploits from warnings, the only real solution is a > panic_on_warning. Yes, it brings down the system, but really, it has to be > brought down anyway, because it is in need of a kernel update. > We also have LIVEPATCH to avoid bringing down the system for a kernel update, don't we ? So I wouldn't expect bringing down a vital system just for a WARN. As far as I understand from https://www.kernel.org/doc/html/latest/process/deprecated.html#bug-and-bug-on, WARN() and WARN_ON() are meant to deal with those situations as gracefull as possible, allowing the system to continue running the best it can until a human controled action is taken. So I'd expect the WARN/WARN_ON to be handled and I agree that that pkill_on_warning seems dangerous and unrelevant, probably more dangerous than doing nothing, especially as the WARN may trigger for a reason which has nothing to do with the running thread. Christophe