Re: A shift-out-of-bounds in minix_statfs in fs/minix/inode.c

["Theodore Ts'o" <tytso@mit.edu>]

On Wed, Jul 21, 2021 at 06:37:23PM +0100, Matthew Wilcox wrote:
> On Thu, Jul 22, 2021 at 01:14:06AM +0800, butt3rflyh4ck wrote:
> > ms = (struct minix_super_block *) bh->b_data; /// --------------> set
> > minix_super_block pointer
> > sbi->s_ms = ms;
> > sbi->s_sbh = bh;
> > sbi->s_mount_state = ms->s_state;
> > sbi->s_ninodes = ms->s_ninodes;
> > sbi->s_nzones = ms->s_nzones;
> > sbi->s_imap_blocks = ms->s_imap_blocks;
> > sbi->s_zmap_blocks = ms->s_zmap_blocks;
> > sbi->s_firstdatazone = ms->s_firstdatazone;
> > sbi->s_log_zone_size = ms->s_log_zone_size;  // ------------------>
> > set sbi->s_log_zone_size
> 
> So what you're saying is that if you construct a malicious minix image,
> you can produce undefined behaviour?  That's not something we're
> traditionally interested in, unless the filesystem is one customarily
> used for data interchange (like FAT or iso9660).

It's going to depend on the file system maintainer.  The traditional
answer is that block device is part of the Trusted Computing Base, and
malicious file system images are not considered part of the threat
model.  A system adminstration or developer which allows potentially
malicious agents to mount file system agents are cray-cray.

Unfortunately, those developers are also known as "Linux desktop devs"
(who implement unprivileged mounts of USB cards) or "container
evangelists" who think containers should be treated as being Just As
Good as VM's From A Security Perspective.

So I do care about this for ext4, although I don't guarantee immediate
response, as it's something that I usually end up doing on my own
time.  I do get cranky that Syzkaller makes it painful to extract out
the fuzzed file system image, and I much prefer those fuzzing systems
which provide the file system image and the C program used to trigger
the failre as two seprate files.  Or failing that, if there was some
trivial way to get the syzkaller reproducer program to disgorge the
file system image to a specified output file.  As a result, if I have
a choice of spending time investigating fuzzing report from a more
file-system friendly fuzzing program and syzkaller, I'll tend choose
to spend my time dealing with other file system fuzzing reports first.

The problem for Minix is that it does not have an active maintainer.
So if you submit fuzzing reports for Minix, it's unlikely anyone will
spend time working on it.  But if you submit a patch, it can go in,
probably via Andrew Morton.  (Recent Minix fixes that have gone in
this way: 0a12c4a8069 and 32ac86efff9)

Cheers,

					- Ted