linux-kernel - Re: [GIT PULL] SCSI fixes for 6.10-rc4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 22 Jun 2024 12:35:32 -0400
From: "Martin K. Petersen" <martin.petersen@...cle.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: "Martin K. Petersen" <martin.petersen@...cle.com>,
        James Bottomley
 <James.Bottomley@...senpartnership.com>,
        Andrew Morton
 <akpm@...ux-foundation.org>,
        linux-scsi <linux-scsi@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Bart Van Assche
 <bvanassche@....org>
Subject: Re: [GIT PULL] SCSI fixes for 6.10-rc4

Hi Linus!

> But I also know that pretty much *EVERY* time the SCSI layer has
> decided to start looking at some new piece of data, it turns out that
> "Oh, look, all those devices have only ever been tested with operating
> systems that did *NOT* look at that mode page or other thing, and
> surprise surprise - not being tested means that it's buggy".

We have been working towards poking the same things in the same order as
a well-known desktop operating system. Explicitly to leverage USB device
manufacturer testing.

> Put another way: why wasn't this an explicit opt-in from the get-go?

Because the expectation is that it will be widely implemented and used
on pretty much anything that speaks SCSI except USB-attached gadgets.
Hence the ask to disable it for the USB transports instead of
complicating things for every other use case.

It is always unfortunate when a change causes regressions. I agree that,
given that this involved a mode page, there should have been extra
safeguards in place. I should have caught that.

-- 
Martin K. Petersen	Oracle Linux Engineering