Re: How trustworthy is that I/O device?

On Nov 6, 2013, at 2:21 PM, Matt Thomas wrote:

> 
> On Nov 4, 2013, at 2:34 PM, Erik Fair <[email protected]> wrote:
> 
>> All OSes have a problem with USB and potentially all other hot-plug I/O busses: can you trust the device that was just plugged into the bus? How much I/O do you permit to it before explicit authorization of some kind?
> 
> I've always wondered why we "trust" file systems and panic they aren't
> what we expect.  We don't do that for networking.  If seems if we encounter
> an inconsistency, we mark the f/s as read-only and either return an error
> or complete the action if possible.

Panic now to prevent crazy later. If the structures are inconsistent, then relying on underlying assumptions in the code is so unsafe we simply can't do it at all.  How do we know that going to read-only doesn't create some kind of excess data disclosure path?

Warner