From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Michael Bommarito <michael.bommarito@gmail.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH] scsi: core: bound the VPD page 0x83 designator walk
Date: Sat, 11 Jul 2026 11:38:31 -0400 [thread overview]
Message-ID: <d561134dc7da37554f276f8ebb1aaa721956ce45.camel@HansenPartnership.com> (raw)
In-Reply-To: <20260711150718.2916641-1-michael.bommarito@gmail.com>
On Sat, 2026-07-11 at 11:07 -0400, Michael Bommarito wrote:
[...]
> Impact: a malicious or malfunctioning SCSI device, or a compromised
> hypervisor block backend, drives an out-of-bounds read of the cached
> VPD page 0x83 buffer (KASAN) during LUN-id, target-port-group, or
> unique-id computation.
This is not a threat model we have for the kernel. The reason has been
much debated but it boils down to the fact that if we do this somewhere
we likely have to do it everywhere and the cost of checking every
return from a device is huge in terms of performance. Thus we assume
devices (and hypervisors) behave correctly until someone finds a buggy
device and only then do we do a workaround.
Regards,
James
prev parent reply other threads:[~2026-07-11 15:38 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-11 15:07 Michael Bommarito
2026-07-11 15:38 ` James Bottomley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d561134dc7da37554f276f8ebb1aaa721956ce45.camel@HansenPartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=michael.bommarito@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®