linux-kernel - Re: [PATCH] scsi: pm8001: Fix potential TOCTOU race in pm8001_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2f7c49e3-302c-30d5-63ac-29412f3c6ed5@linux-m68k.org>
Date: Wed, 21 Jan 2026 10:43:12 +1100 (AEDT)
From: Finn Thain <fthain@...ux-m68k.org>
To: James Bottomley <James.Bottomley@...senPartnership.com>
cc: Chengfeng Ye <dg573847474@...il.com>, 
    "Martin K . Petersen" <martin.petersen@...cle.com>, 
    Jack Wang <jinpu.wang@...ud.ionos.com>, linux-scsi@...r.kernel.org, 
    linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: pm8001: Fix potential TOCTOU race in
 pm8001_find_tag

On Tue, 20 Jan 2026, James Bottomley wrote:

> 
> But this too is a problem: fixes aren't free.  In fact a portion of the 
> patches sold as a bug fix eventually turn out to introduce a bug ... and 
> that new bug is one we didn't have before. This is just a sad 
> consequence of the fact that all code produced by humans contains bugs.

Yes. And if the shiny new tool has agency inasmuchas it tests patches in 
emulators, then the code produced by the new tool will also contain bugs.

Perhaps there are cycle-accurate, hardware-bug-compatible emulators for a 
few hardware designs. But asserting the correctness (hardware-equivalence) 
of such emulators runs into the very same problem.

So, unless tested on suitable hardware, one might expect driver patch 
submissions to be rejected with little or no review.