On 08/16/26 at 02:13pm, Lukas Wunner wrote: > On Wed, Aug 12, 2026 at 12:08:39PM +0200, Jan Sebastian Götte wrote: > > I can imagine one alternative way to approach this, tell me what you think: > > Instead of registering wipe handlers that memzero places on panic, I could > > put an optional registry of (addr, len) descriptors into crashkernel memory > > that the original kernel populates with the PAs of buffers to clear ahead of > > time. Then the kdump kernel could do the actual memzero. This would remove > > all code from the actual kdump path here. The registry could be made > > per-core to avoid locks.
Since there are a lot of security expert in CC, I am wondering what's the risk if we wipe secrets during dumping. System is located in user's place, and vmcore is dumped and collected in user's place. If we filter out secrets memory when we dumping, what could be leaked out? > > Or create a dedicated mempool from which all sensitive data is allocated, > then call mempool_free_bulk() on kexec to poison everything in that pool? > > Thanks, > > Lukas
