[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[dm-devel] Re: "Enhanced" MD code avaible for review



Justin T. Gibbs wrote:
The kernel should not be validating -trusted- userland inputs.  Root is
allowed to scrag the disk, violate limits, and/or crash his own machine.

A simple example is requiring userland, when submitting ATA taskfiles via
an ioctl, to specify the data phase (pio read, dma write, no-data, etc.).
If the data phase is specified incorrectly, you kill the OS driver's ATA
host wwtate machine, and the results are very unpredictable.   Since this
is a trusted operation, requiring CAP_RAW_IO, it's up to userland to get the
required details right (just like following a spec).


That's unfortunate for those using ATA. A command submitted from userland

Required, since one cannot know the data phase of vendor-specific commands.



to the SCSI drivers I've written that causes a protocol violation will
be detected, result in appropriate recovery, and a nice diagnostic that
can be used to diagnose the problem.  Part of this is because I cannot know
if the protocol violation stems from a target defect, the input from the
user or, for that matter, from the kernel.  The main reason is for robustness

Well, * the target is not _issuing_ commands, * any user issuing incorrect commands/cdbs is not your bug, * and kernel code issuing incorrect cmands/cdbs isn't your bug either

Particularly, checking whether the kernel is doing something wrong, or wrong, just wastes cycles. That's not a scalable way to code... if every driver and Linux subsystem did that, things would be unbearable slow.

Jeff




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]