<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>This patch (and "<span class="Apple-style-span" style="font-size: 12px; font-weight: bold; ">[dm-devel] [PATCH 3/8] connector/dm: Fixed a compilation warning<span class="Apple-style-span" style="font-size: medium; font-weight: normal; ">") will likely collide with an earlier patch (which agk is pushing) to fix the compilation warning (<a href="https://www.redhat.com/archives/dm-devel/2009-September/msg00218.html)">https://www.redhat.com/archives/dm-devel/2009-September/msg00218.html)</a>, but the fix-up will be trivial.</span></span></div><div><br></div><div>The dm-log-userspace code checks that incoming messages correspond to requests that were sent to userspace by way of a sequence number. If they don't correspond, they are dropped. So, you must be able to receive the messages from this kernel module (be root) in order to be able respond with a message that will be accepted. I can't completely rule out the ability to guess a sequence number, and be able to beat the log daemon in responding while the window of that sequence number's validity is open though... If someone could manage to pull this off with accuracy, they could disrupt the creation of a device, mimic a log device failure, or cause mirror resynchronization to occur to a different area that may simultaneously be performing a write (potential data corruption of a mirror). It would be an impressive feat to accomplish this, but I very much welcome the patch rather than test fate.</div><div><br></div>Reviewed-by: Jonathan Brassow <<a href="mailto:jbrassow@redhat.com">jbrassow@redhat.com</a>><br><div><div><br></div><div> brassow</div><div><br></div><div>On Oct 2, 2009, at 7:40 AM, Philipp Reisner wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Signed-off-by: Philipp Reisner <<a href="mailto:philipp.reisner@linbit.com">philipp.reisner@linbit.com</a>><br>---<br> drivers/md/dm-log-userspace-transfer.c | 3 +++<br> 1 files changed, 3 insertions(+), 0 deletions(-)<br><br>diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c<br>index 1327e1a..54abf9e 100644<br>--- a/drivers/md/dm-log-userspace-transfer.c<br>+++ b/drivers/md/dm-log-userspace-transfer.c<br>@@ -133,6 +133,9 @@ static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)<br> {<br> <span class="Apple-tab-span" style="white-space:pre"> </span>struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);<br><br>+<span class="Apple-tab-span" style="white-space:pre"> </span>if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))<br>+<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>return;<br>+<br> <span class="Apple-tab-span" style="white-space:pre"> </span>spin_lock(&receiving_list_lock);<br> <span class="Apple-tab-span" style="white-space:pre"> </span>if (msg->len == 0)<br> <span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>fill_pkg(msg, NULL);<br>-- <br>1.6.0.4<br><br>--<br>dm-devel mailing list<br><a href="mailto:dm-devel@redhat.com">dm-devel@redhat.com</a><br>https://www.redhat.com/mailman/listinfo/dm-devel<br></div></blockquote></div><br></body></html>