Valid structures and bugs
Valid structures and bugs
Posted Sep 1, 2024 9:26 UTC (Sun) by farnz (subscriber, #17727)In reply to: WUFFS and the Linux kernel by pizza
Parent article: Standards for use of unsafe Rust in the kernel
That's part of what I mean by "change the way you think"; if you've designed your filesystem such that constructs that are valid in isolation result in kernel bugs when combined, you have a problem. If you merely have a situation where the kernel remains bug-free, but there's data loss on a corrupt filesystem due to the conflicting structures (e.g. two inodes sharing an extent record means that either inode can modify that extent record), then you don't have a problem.
And part of this is distinguishing severities of bug; a filesystem bug that gives me total control of your machine because a consequence of an impossible construct being present is that the kernel jumps to an attacker-controller address is a different type of bug to one where the filesystem, when faced with a corrupted filesystem image, corrupts it further.