lkml.org 
[lkml]   [2000]   [Jul]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: disk-destroyer.c
On Fri, 21 Jul 2000, Oliver Xymoron wrote:

> No, of course not, but we also don't want to make large changes to the
> kernel to paper over a hole that we can't cement closed. Especially now.

Here is you damn steel-plate-of-armor!
I can close this hole completely and you will never know the difference
based on all the known user-space tools that call the "HDIO_DRIVE_CMD".

If you enable the "CONFIG_IDE_TASK_IOCTL" option then you have made the
choice to expose your hardware. The level of access that this code access
is not for the novice or stupid. This is playing russian-rulet with a
full gun. How carefully you shoot yourself in the head determines if you
LIVE or DIE!

static int ide_ioctl (struct inode *inode, struct file *file,
unsigned int cmd, unsigned long arg)
{
.....
case HDIO_DRIVE_CMD:
case HDIO_DRIVE_TASK:
{
.....
if (NULL == (void *) arg) {
} else if (cmd == HDIO_DRIVE_CMD) {
/* READ TaskFile put in the right order for DRIVE_TASK */
} else {
/* READ Full TaskFile and do it now HDIO_DRIVE_TASK */
#ifdef CONFIG_IDE_TASK_IOCTL
if (copy_from_user(argsptr, (void *)arg, tasksize))
#endif /* CONFIG_IDE_TASK_IOCTL */
return -EFAULT;
}

commandtype = ide_cmd_type_parser(&args);


The "ide_cmd_type_parser" is the filter!

/* Called by ioctl to feature out type of command being called */

int ide_cmd_type_parser (ide_task_t *args)
{
switch(args->tfRegister[IDE_COMMAND_OFFSET]) {
case WIN_IDENTIFY:
case WIN_PIDENTIFY:
args->handler = &task_in_intr;
return IDE_DRIVE_TASK_IN;
case CFA_TRANSLATE_SECTOR:
case WIN_READ:
case WIN_READ_BUFFER:
args->handler = &task_in_intr;
return (args->command_type == IDE_DRIVE_CMD) ? IDE_DRIVE_TASK_INVALID : IDE_DRIVE_TASK_IN;

case WIN_WRITE:
case WIN_WRITE_VERIFY:
case WIN_WRITE_BUFFER:
case CFA_WRITE_SECT_WO_ERASE:
case WIN_DOWNLOAD_MICROCODE:
args->handler = &task_out_intr;
return (args->command_type == IDE_DRIVE_CMD) ? IDE_DRIVE_TASK_INVALID : IDE_DRIVE_TASK_RAW_WRITE;

Damn-it here is you CEMENT!!!!!!!!!

Do you want this to be executable if you system gets hacked!
You know SCSI has the same problem but I have no interest in fixing that
problem if I can not fix this one.

NOW try to break the damn kernel with out FULL TASKFILE COMMANDS enabled
and you get no help from the kernel.

You have to read the ATA-ATAPI standard, invoke Rogier "ints" module,
IOPERM the shit out of the kernel, then know what the FUCK to do.

Can you do that........I fucking can and stroke the ext2 libs to help
me as a user. Now I quit!

Everybody can just let there hardware get FUCK!

Nobody wants waht took three months to create.
I would never allow code that can destroy the subsystem out for pure
alpha/beta testing. You do not get reports from systems with out DATA
eeh!

Later......I am really pissed now because you and everyone think I am
chicke little!



Andre Hedrick
The Linux ATA/IDE guy



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.123 / U:0.144 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site