Re: [PATCH printk 3/6] printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()

[John Ogness]

On 2026-11-09, Breno Leitao <leitao@xxxxxxxxxx> wrote:
>> @@ -1572,7 +1608,12 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, enum pr_flush_r
>>  	ctxt->console			= con;
>>  	ctxt->spinwait_max_us		= 2000;
>>  	ctxt->prio			= nbcon_get_default_prio();
>> -	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover();
>> +	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover(con, reason);
>
>
> Thanks for the series, I've tried it here, and I got:

Thanks for testing.

>   sysrq: Resetting
>     ------------[ cut here ]------------
>     WARNING: kernel/printk/nbcon.c:561 at nbcon_context_try_acquire+0x72c/0x790, CPU#0: sh/212
>     Modules linked in: nbcon_hold(OE+)
>     CPU: 0 UID: 0 PID: 212 Comm: sh Tainted: G           OE       7.4.0-rc1-next-20261105upstream-00006-g4170adac69fb #1 PREEMPT(full)
>     Hardware name: linux,dummy-virt (DT)
>     pc : nbcon_context_try_acquire+0x72c/0x790
>     lr : nbcon_context_try_acquire+0x508/0x790
>     ...
>     Call trace:
>      nbcon_context_try_acquire+0x72c/0x790 (P)
>      __nbcon_atomic_flush_pending_con+0x1c0/0x358
>      nbcon_atomic_flush_pending+0x224/0x390
>      printk_trigger_flush+0x50/0x1c8
>      emergency_restart+0x54/0x98
>      sysrq_handle_reboot+0x5c/0x88
>      __handle_sysrq+0x298/0x3c0
>      write_sysrq_trigger+0x178/0x1d0
>      proc_reg_write+0x148/0x270
>      vfs_write+0x1d4/0x7c8
>      ksys_write+0xbc/0x168
>      __arm64_sys_write+0x88/0xa8
>      invoke_syscall+0x74/0x188
>      do_el0_svc+0x108/0x190
>      el0_svc+0x60/0x1d8
>      el0t_64_sync_handler+0x68/0xe0
>      el0t_64_sync+0x198/0x1a0
>
> That is coming from:
>
>    550 static int nbcon_context_try_acquire_hostile(struct nbcon_context *ctxt,
>    551                                              struct nbcon_state *cur)
>    552 {
>    553         unsigned int cpu = smp_processor_id();
>    554         struct console *con = ctxt->console;
>    555         struct nbcon_state new;
>    556
>    557         if (!ctxt->allow_unsafe_takeover)
>    558                 return -EPERM;
>    559
>    560         /* Ensure caller is allowed to perform unsafe hostile takeovers. */
>    561         if (WARN_ON_ONCE(ctxt->prio != NBCON_PRIO_PANIC))
>    562                 return -EPERM;

Wow, you managed to get a hostile takeover. Out of curiousity, do you
know how dangerous this really is? Can this basically just result in
garbage on the network? Or is there dangers of running into the forest
with NULL or garbage pointers? And is the danger acceptable?

@pmladek: I expect we just need to remove the WARN_ON_ONCE() since this
series introduces unsafe takeovers when not in panic. Do you agree?

John