From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pandora.armlinux.org.uk (pandora.armlinux.org.uk [78.32.30.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 716B436CE10 for ; Mon, 29 Jun 2026 12:07:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=78.32.30.218 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782734873; cv=none; b=oH0LU5qF6qV1Wdk18ElGMVR4PCKiAqEThNU0bGkkwh7APp/UVeQT3sOhKoHVW2n2uwczke5ZcAtczuNqSwhTbc9kPuIw65zF7vhZGUqyEfLQ14I3vxKcve1lntJ1H9aMBf/B6WYS7ociZnlm1DK5M8FR9+02d2uiWLM3Y9hk3ec= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782734873; c=relaxed/simple; bh=OW7jUq+eAMZ9eOJl5ZU0rZJ3wLBpT6cuTQgu9p23Ro8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=gQ9hCl741jo64AG44ucEZh6uIFQaZR+TyoEnz/bL4KJ4bsu1aTh9YzK8GgMqS3tVgCbeK5V1Q9rEp/MwTO1yjs5Us/pvhKoSEj57wPSt7Hi3kzCE3AU7nuY+aZxfLabN7iedXhw9a58Wpw7+/4JQ0TFxjUFceYB0mv+6eVEAfvM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=armlinux.org.uk; spf=none smtp.mailfrom=armlinux.org.uk; dkim=pass (2048-bit key) header.d=armlinux.org.uk header.i=@armlinux.org.uk header.b=gSDscbEu; arc=none smtp.client-ip=78.32.30.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=armlinux.org.uk Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=armlinux.org.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=armlinux.org.uk header.i=@armlinux.org.uk header.b="gSDscbEu" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=armlinux.org.uk; s=pandora-2019; h=Sender:In-Reply-To: Content-Transfer-Encoding:Content-Type:MIME-Version:References:Message-ID: Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=K2NnMnb6actGsfGWBeqkdiGTirglxW/xkbqtDOmpfKo=; b=gSDscbEuRegP+TY7KauEXdeRoh yvzn6Np4V9Y0F3GyKrpZwoBkp/Haoq5V9/rJBRN/WG0jr5Uak/DoNrxTMrEE3HUKlXZZo0hHzV/Xs XOOEdq/+NWDpc1uArvL8ffMqE+xpuKwLKHT8Qn4OUKNkNtnmzdRFHYObn0295vOQSM/nqjQzVLqo1 aLmNKJ4fzS0dH/usXa/K0vYpNKpoGw6EJcoxLDL7afn7AiLIRztYoQ5vX59y4uMJRjPBTviyIHTWc R1OHGU4tcDgJr09yVYn8BKamHiHRss7KSaOkmnPZktZo6jUOS2hDVuOJ3K0JiprfqMqriTB1RnX5c 6DGOE2PQ==; Received: from shell.armlinux.org.uk ([fd8f:7570:feb6:1:5054:ff:fe00:4ec]:38560) by pandora.armlinux.org.uk with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1weAmA-000000005G7-3HDa; Mon, 29 Jun 2026 13:07:46 +0100 Received: from linux by shell.armlinux.org.uk with local (Exim 4.98.2) (envelope-from ) id 1weAm8-000000005sX-3MXz; Mon, 29 Jun 2026 13:07:44 +0100 Date: Mon, 29 Jun 2026 13:07:44 +0100 From: Russell King To: Samuel Moelius Cc: kees@kernel.org, brauner@kernel.org, iwasbaeyz@gmail.com, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk Subject: Re: [PATCH v2 1/2] adfs: reject disc records smaller than one filesystem block Message-ID: References: <202606101323.0DFB06B054@keescook> <20260628220126.94212-1-sam.moelius@trailofbits.com> <20260628220126.94212-2-sam.moelius@trailofbits.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Sender: "Russell King,,," On Mon, Jun 29, 2026 at 07:45:21AM -0400, Samuel Moelius wrote: > On Mon, Jun 29, 2026 at 7:34 AM Russell King wrote: > > > > On Mon, Jun 29, 2026 at 07:07:57AM -0400, Samuel Moelius wrote: > > > On Sun, Jun 28, 2026 at 7:17 PM Russell King wrote: > > > > > > > > On Sun, Jun 28, 2026 at 10:01:25PM +0000, Samuel Moelius wrote: > > > > > ADFS uses the on-disk disc size to report statfs block counts. The disc > > > > > record validator checks the sector size, id length, high disc-size bits, > > > > > map zone count, and reserved bytes, but it accepts a declared disc size > > > > > smaller than one filesystem block. > > > > > > > > > > A crafted one-zone image with log2secsize 9 and disc_size 1 can pass map > > > > > checksum validation and mount. A subsequent statfs then reports zero > > > > > f_blocks from adfs_map_statfs(), and adfs_statfs() divides by that zero > > > > > while deriving f_ffree. > > > > > > > > I think this is still too low. > > > > > > > > 1. The disc map is nzones sectors long, and can not be in the same > > > > sector as the boot block. The disc record can not share with the map. > > > > This means the minimum is 1 + nzones sectors to fit just the map in. > > > > > > > > 2. If the disc record was found at 0xc00 rather than 0, then that > > > > will add sectors to the minimum size. > > > > > > > > 3. The root directory is also necessary, which is 2048 bytes for an > > > > E/F format (format_version=0) or root_size for an F+ format. > > > > > > > > So, if we're really trying to avoid mounting something that isn't a > > > > proper image, then just checking that the disc size is at least one > > > > sector isn't sufficient. > > > > > > I understand your points, but the intent of this patch was simply to > > > eliminate a divide-by-zero. Is it sufficient for that purpose? > > > > While it is, you are also introducing selftests that rely on your > > behaviour, where you merge the disc record with the map for both > > of your test cases. This should also be rejected, because the bytes > > in the disc record will be interpreted as the disc map. > > > > Have you checked what happens if you attempt to access such a bad > > image, or are you purely focussed on what an AI bot told you was > > a problem, rather than looking at the bigger picture? > > I have not attempted to access the bad image. And to be clear, the > selftest was an attempt to address Kees Cook's request here: > https://lore.kernel.org/all/202606101323.0DFB06B054@keescook/ > > > Can you create a tools/testing/selftests/ script that will generate a > > good and bad image and attempt to mount both, validating the filesystem > > checking logic you're adding here? > > Would another approach be better? So, in essence, - a bug was found (divide by zero) caused by an invalid image, presumably by AI. - a patch was generated to address _just_ that issue without looking at the bigger picture. - Kees requested a selftest for it - A selftest was created which _itself_ generates two filesystem images, both of which are technically invalid, but tests that one mounts but the other doesn't, and the kernel doesn't have the divide by zero. - No check whether the mounted "good" filesystem doesn't cause other issues. - Author resists suggestions from filesystem maintainer to improve the check. Fixing the bigger picture will result in the selftest failing, because the invalid "good" image is still invalid, and that makes patch 2 incorrect. Sorry, but no. While I'm here, another thing that should be checked - that the disc size specified in the disc record isn't larger than the block device being mounted. -- RMK's Patch system: https://www.armlinux.org.uk/developer/patches/ FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!