History

kernel: add panic_on_taint

Analogously to the introduction of panic_on_warn, this patch introduces a kernel option named panic_on_taint in order to provide a simple and generic way to stop execution and catch a coredump when the kernel gets tainted by any given flag. This is useful for debugging sessions as it avoids having to rebuild the kernel to explicitly add calls to panic() into the code sites that introduce the taint flags of interest. For instance, if one is interested in proceeding with a post-mortem analysis at the point a given code path is hitting a bad page (i.e. unaccount_page_cache_page(), or slab_bug()), a coredump can be collected by rebooting the kernel with 'panic_on_taint=0x20' amended to the command line. Another, perhaps less frequent, use for this option would be as a means for assuring a security policy case where only a subset of taints, or no single taint (in paranoid mode), is allowed for the running system. The optional switch 'nousertaint' is handy in this particular scenario, as it will avoid userspace induced crashes by writes to sysctl interface /proc/sys/kernel/tainted causing false positive hits for such policies. [akpm@linux-foundation.org: tweak kernel-parameters.txt wording]

Rafael Aquini committed 6 years ago

Commit db38d5c1 parent ceabef76 files · +75 −1Browse files

Showing the changes to include/linux (1 of 6 files). Show all

Unified · Split

include/linux/kernel.h+3−0
@@ -528,6 +528,8 @@ extern int panic_on_oops; · 527 unmodified lines
528extern int panic_on_unrecovered_nmi;528extern int panic_on_unrecovered_nmi;
529extern int panic_on_io_nmi;529extern int panic_on_io_nmi;
530extern int panic_on_warn;530extern int panic_on_warn;
531extern unsigned long panic_on_taint;
532extern bool panic_on_taint_nousertaint;
531extern int sysctl_panic_on_rcu_stall;533extern int sysctl_panic_on_rcu_stall;
532extern int sysctl_panic_on_stackoverflow;534extern int sysctl_panic_on_stackoverflow;
533 535
@@ -596,6 +598,7 @@ extern enum system_states { · 62 unmodified lines
596#define TAINT_AUX 16598#define TAINT_AUX 16
597#define TAINT_RANDSTRUCT 17599#define TAINT_RANDSTRUCT 17
598#define TAINT_FLAGS_COUNT 18600#define TAINT_FLAGS_COUNT 18
601#define TAINT_FLAGS_MAX ((1UL << TAINT_FLAGS_COUNT) - 1)
599 602
600struct taint_flag {603struct taint_flag {
601 char c_true; /* character printed when tainted */604 char c_true; /* character printed when tainted */