panic_on_warn and lack of lesser-WARN (was: Re: [PATCH nf] netfilter: nf_nat: do not reuse an unexpected expectation on RTCP clash)

Greg KH <[email protected]> wrote:
> > > True, but adding new ones is not a good idea, and removing the existing
> > > ones is a good idea.
> > 
> > We're fucked, then.  Can we at least use DEBUG_NET_WARN or something
> > like that so at least fizzers can give us hints about bugs?!
> 
> That's up to you.  If panic_on_warn wasn't an option, about half of the
> kernel CVEs would disappear tomorrow.

That explains your WARN() allergy, I can relate to that.

Its a shame there is nothing like WARN_BENIGN() or similar that doesn't
panic even with panic_on_warn=1.

I get some people really want s/WARN/BUG at run time for things
like "this list is corrupted" or "you tried refcount_inc() on a 0
refcount".  But even for "this refcount is saturated" I don't get
why you want to crash the system right away.

Feels a bit like setting your car on fire because the side window was
slightly dirty :-)