On Tue, Nov 15, 2016 at 5:03 AM, Ingo Molnar <mi...@kernel.org> wrote: > > * Peter Zijlstra <pet...@infradead.org> wrote: > >> On Tue, Nov 15, 2016 at 11:03:59AM +0100, Ingo Molnar wrote: >> > > Should I also make a CONFIG knob that implements refcount_t with the >> > > 'normal' atomic_t primitives? >> > >> > I'd suggest doing the saturation/safe-wrap semantics only for now (i.e. the >> > current patch, split into two perhaps), and reconsider if there's any >> > complaints? >> > >> > > And possibly another knob to toggle the BUG()s into WARN()s. With the >> > > full saturation semantics WARN() is a lot safer and will not corrupt >> > > kernel state as much.
I'll want to modify this in the future; I have a config already doing "Bug on data structure corruption" that makes the warn/bug choice. It'll need some massaging to fit into the new refcount_t checks, but it should be okay -- there needs to be a way to complete the saturation, etc, but still kill the offending process group. -Kees -- Kees Cook Nexus Security
