[PATCH v7 0/6] panic: fix panic_force_cpu= redirect races and NMI bypass

Bradley Morgan posted 6 patches 1 week, 1 day ago
drivers/watchdog/hpwdt.c |  2 +-
include/linux/panic.h    |  3 +-
kernel/panic.c           | 80 ++++++++++++++++++++++------------------
3 files changed, 47 insertions(+), 38 deletions(-)
[PATCH v7 0/6] panic: fix panic_force_cpu= redirect races and NMI bypass
Posted by Bradley Morgan 1 week, 1 day ago
The panic_force_cpu= parameter redirects a panic to a specific CPU so
the crash kernel runs there. The redirect code in panic_try_force_cpu()
had two races and an NMI bypass, all found by Sashiko. This series
closes them and kills one more hack that the rework turned up.

Changes since v6, all from Petr's review:

Patch 4 now fixes the -Wformat-security warning that the __printf
annotation tripped in hpwdt, the closest caller: nmi_panic() there
passes a stack buffer, so it calls nmi_panic(regs, "%s", panic_msg)
now. The "every caller passes a plain string literal" claim is gone
from the changelog, it was wrong anyway, hpwdt never did. The
duplicate __printf annotation was dropped from the .c definition, the
header carries it.

Patch 6 dropped the "return value is not even checked" sentence from
the changelog. The kmalloc is gone entirely in this version, and the
self report on failure was deliberate anyway. The now constant msg
variable is gone too, panic_force_buf is passed directly.

Everything else is unchanged from v6. Patches 1, 2, 3 and 5 carry
Petr's Reviewed-by from the v6 thread. The double warning when a CPU
goes offline while marked in the panic mask and the set_cpu_online()
asymmetry in nmi_panic stay as they are, Petr called both not worth
touching. Rebased onto current master, the arch_do_panic rework from
Aug 31 merged cleanly on top.

Panic from NMI still goes through the redirect path first, so the
crash kernel ends up on the CPU the admin asked for. The redirect
buffer is a static 1KB now, no initcall, no fallback message.


Bradley Morgan (6):
  panic: fix redirect CPU race in panic_try_force_cpu()
  panic: flatten nmi_panic control flow
  panic: fix va_list reuse in panic_try_force_cpu()
  panic: restore variable arguments to nmi_panic()
  panic: allow force_cpu redirect from an NMI
  panic: kill the "buffer unavailable" redirect fallback

 drivers/watchdog/hpwdt.c |  2 +-
 include/linux/panic.h    |  3 +-
 kernel/panic.c           | 80 ++++++++++++++++++++++------------------
 3 files changed, 47 insertions(+), 38 deletions(-)

-- 
2.47.3
Re: [PATCH v7 0/6] panic: fix panic_force_cpu= redirect races and NMI bypass
Posted by Petr Mladek 2 days, 14 hours ago
On Wed 2026-09-16 18:29:51, Bradley Morgan wrote:
> The panic_force_cpu= parameter redirects a panic to a specific CPU so
> the crash kernel runs there. The redirect code in panic_try_force_cpu()
> had two races and an NMI bypass, all found by Sashiko. This series
> closes them and kills one more hack that the rework turned up.

IMHO, this version is ready to go. It would be great to fix the commit
message in the 4th patch but I think that Andrew could do the fixup.

Best Regards,
Petr
Re: [PATCH v7 0/6] panic: fix panic_force_cpu= redirect races and NMI bypass
Posted by Bradley Morgan 2 days, 12 hours ago
On 22 September 2026 13:35:54 BST, Petr Mladek <pmladek@suse.com> wrote:
>On Wed 2026-09-16 18:29:51, Bradley Morgan wrote:
>> The panic_force_cpu= parameter redirects a panic to a specific CPU so
>> the crash kernel runs there. The redirect code in panic_try_force_cpu()
>> had two races and an NMI bypass, all found by Sashiko. This series
>> closes them and kills one more hack that the rework turned up.
>
>IMHO, this version is ready to go. It would be great to fix the commit
>message in the 4th patch but I think that Andrew could do the fixup.
>

Akpm? Up for it?

>Best Regards,
>Petr
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds
Re: [PATCH v7 0/6] panic: fix panic_force_cpu= redirect races and NMI bypass
Posted by Andrew Morton 2 days, 4 hours ago
On Tue, 22 Sep 2026 15:41:52 +0100 Bradley Morgan <brads@mainlining.org> wrote:

> On 22 September 2026 13:35:54 BST, Petr Mladek <pmladek@suse.com> wrote:
> >On Wed 2026-09-16 18:29:51, Bradley Morgan wrote:
> >> The panic_force_cpu= parameter redirects a panic to a specific CPU so
> >> the crash kernel runs there. The redirect code in panic_try_force_cpu()
> >> had two races and an NMI bypass, all found by Sashiko. This series
> >> closes them and kills one more hack that the rework turned up.
> >
> >IMHO, this version is ready to go. It would be great to fix the commit
> >message in the 4th patch but I think that Andrew could do the fixup.
> >
> 
> Akpm? Up for it?

Done, thanks.