Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 22 Jul 2021 11:09:45 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Matthew Wilcox <willy@infradead.org>
Cc:     butt3rflyh4ck <butterflyhuangxx@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>,
        linux-fsdevel@vger.kernel.org,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: A shift-out-of-bounds in minix_statfs in fs/minix/inode.c
Message-ID: <20210722080945.GY1931@kadam>
References: <CAFcO6XOdMe-RgN8MCUT59cYEVBp+3VYTW-exzxhKdBk57q0GYw@mail.gmail.com>
 <YPhbU/umyUZLdxIw@casper.infradead.org>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YPhbU/umyUZLdxIw@casper.infradead.org>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from kadam (102.222.70.252) by JNXP275CA0003.ZAFP275.PROD.OUTLOOK.COM (2603:1086:0:19::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4352.25 via Frontend Transport; Thu, 22 Jul 2021 08:10:00 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 111589f0-4a23-435a-7f54-08d94ce81cd1
X-MS-TrafficTypeDiagnostic: MWHPR10MB1376:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <MWHPR10MB13760FD4E9CE35FCE8EEE0C48EE49@MWHPR10MB1376.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:669;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: RNP2gmGB6J+i9sU3SNEcdc98sHehPB40rFql7rI7At4OPlZjcAt4YQqu989qDg+YGuPwrGdohhxBKVk8Jl8Xk+3RFg479NXqjEBHZqYY4xweXmsepLMAPwHj9/zm2jlMfqcfz286wbQi6dyhq129BeX/x5YbGubA2tqziotQdcQZXydPc2v7qytNaSuXYoHx+ZbGgMyeWlxBjFU+yC2qFBJUxht7QRbQ8jYkJ36nQ0XMjLaWiIK6/8YA4umyOtkxw8srngf5MmRjzFH9BRjLhDAtGHM8qmhURe1/Zj89MjQOh7KeuJ7xIqQGBy0gUhHlLE5ZawGSYnhVuTWGqIcrRfiZAkJ/FLdP1rfkz0W0rh11B+EAc0icIUtqtGc4GxWZANPbQ+Oi9C/P9iOWNH1DaMbS7DXgtHAhKpd8w4ed3jmpkx6ry/CvpA+ju6nWT5uaqYFkyVAhYJDi4OFcjCpStBeiBxMhw/rTUjyDziwmKYMWG1z6p+F7sKKA+52mP4TXsh4G7sTstdiJBlcTKBQ5JH4zO61wmUMt5Bw86uZwigVsl5RJgzURyReciwtPntiL5v+1cGG1aPpNIecmf3u/2+fmBA1g0kGgrJ9jDX8Lq11Hpcmvu1BTaNoJlVF81+KgHW95c+xpM9eCUqpH3QZwi3TxDQl+OvrMie1TOVM6YGKUfexs9HGTCglpBoSPDb0miNTAXC+emxhNc7R+kYRe+g==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MWHPR1001MB2365.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(346002)(396003)(376002)(366004)(39860400002)(136003)(186003)(9576002)(52116002)(1076003)(26005)(33656002)(38350700002)(6496006)(66946007)(4326008)(5660300002)(44832011)(956004)(83380400001)(9686003)(33716001)(66476007)(2906002)(66556008)(86362001)(316002)(6916009)(54906003)(55016002)(8676002)(8936002)(6666004)(38100700002)(478600001);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?3IIr5mkkkvCWR/MJBDV/yxCFPF2joNa9lM/RskCaCjFC30qhLS0vZfIfIhX4?=
 =?us-ascii?Q?b35x0wnFm03jpW17/Uj/EjBi0t4wj9gIafLZpJh7reNEwnfXbIj5JElecW+o?=
 =?us-ascii?Q?RpCSBKRY+RX3uJU33ynIXOCIcE64MG0TuALePM6APYTYCjCyUrrCpaqhCxRD?=
 =?us-ascii?Q?tvvdUna27THW/bVkwDsPPiZzakPULaaPRPrnOuPYaTkkEovS7iYyGNAExBmo?=
 =?us-ascii?Q?zaH51NL90S/018bukRG9CcNMA/5cJVBwc9yWLAVvcdwk+MAlQv+LkCdQT3BE?=
 =?us-ascii?Q?9GHbRBbaSB99Zi+v4EX1oPsUsWdWFUh/0T82rNh8gbHoFIk6ZWTikq51XtA1?=
 =?us-ascii?Q?g0ioDlMAZ+d/uAVhM3Wj0H75J5x8YC7wvMURa7hsD/Wi8kQzdOFQPaY4JUQz?=
 =?us-ascii?Q?YQzVHxPCcR7zkF99CUK/gFCo3GPVWG4+Q+PLVz4y1GRah+dD5g5n/nJCJpQ2?=
 =?us-ascii?Q?LMZxS/WFejT0A/+sjYeubl/yr+yT1hImFe/aOA1Q00UFbMuID0jszx97I7MP?=
 =?us-ascii?Q?MzvfAPV5CJvG5WNNQ6PsWrCWpv8vYD4bv0HNbMrPftrKubO+b+ySKVPaNcfn?=
 =?us-ascii?Q?7KlgiDJ4gGWr8rFL0NFRCHhVRtfcSDL3Kqy0OBDxAhSym0mbqlPkg4rrXMJ2?=
 =?us-ascii?Q?idxhwzWb6/oTg+bYdiKqLfrptJLC/cOGupyDW1o2aWYBFa5fz+kDrNlTNQUC?=
 =?us-ascii?Q?Oo/qOWu11IvuXCGf9hW9CuiAJpF43iWohL4jxseGmG608ijYtciQ0o8aHm0h?=
 =?us-ascii?Q?s7/NIUyy8PW9FqErV1dGr0K/WRKfnDhSkvf8FuFMwwTAnBYWTT64EgGMLisL?=
 =?us-ascii?Q?ZCdSLPoYTux5xiftjgqnkzfbq1cY9J24Y370ZPap40k/AH9JkE1LTXKXqwta?=
 =?us-ascii?Q?Hw9Knxuq85IwTgQnOBsGOMVJC3sB1OTbN0+P4qBjmyAx2eUi/9wrxn+U+QFP?=
 =?us-ascii?Q?jwH9oOCVzcV/20tDU5JVrp22f7vRvi/q891rk7o9bsbgBEfgVhKQMPKWNM2v?=
 =?us-ascii?Q?dpZrnUYR73bxE63Ra93bV+AgMOVygxt1f3MsDznXTm9AMH13NjZsoSd7wRrQ?=
 =?us-ascii?Q?87/7csCqNTla1QyTOSBXi84ZYcgzAL9K46tFEFQ7CvBNvVFlkyY2fENubfeD?=
 =?us-ascii?Q?yzGKRmzY6NJ5OYzJ9gBlFt5cZZ/8CfaJxRNv3wwnJ7PKKZ2h2KGuqSRnhyZF?=
 =?us-ascii?Q?/KJ6lac9O87qxn9sO1hER3rsNCQBJfb3kZGcdDwT0qDEtDEkNeb/GYE4sKfi?=
 =?us-ascii?Q?OYF3JZCjeLV7eC72wGCP5UW7Iisj/HQzzaXSd4j/X8GRejVHx00gSod9R2xg?=
 =?us-ascii?Q?vAumFLvXLs4mUwN7MR/O6MvC?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 111589f0-4a23-435a-7f54-08d94ce81cd1
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jul 2021 08:10:05.5427
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gFfNf/w07lPYlHI5pnLZfxJSORny2bMEbNL7yoJyeo6lAWMXGwF/76dZ66yHpztuodH0vhTQpZpzvgPKUWy8jAMFjECgRp09EqGdDE/fCVY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1376
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10052 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 malwarescore=0 spamscore=0
 mlxscore=0 adultscore=0 mlxlogscore=954 suspectscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000
 definitions=main-2107220051
X-Proofpoint-ORIG-GUID: 1pDYoJZktvzfOzv-uuP88zCh-wykCcSu
X-Proofpoint-GUID: 1pDYoJZktvzfOzv-uuP88zCh-wykCcSu
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Jul 21, 2021 at 06:37:23PM +0100, Matthew Wilcox wrote:
> On Thu, Jul 22, 2021 at 01:14:06AM +0800, butt3rflyh4ck wrote:
> > ms = (struct minix_super_block *) bh->b_data; /// --------------> set
> > minix_super_block pointer
> > sbi->s_ms = ms;
> > sbi->s_sbh = bh;
> > sbi->s_mount_state = ms->s_state;
> > sbi->s_ninodes = ms->s_ninodes;
> > sbi->s_nzones = ms->s_nzones;
> > sbi->s_imap_blocks = ms->s_imap_blocks;
> > sbi->s_zmap_blocks = ms->s_zmap_blocks;
> > sbi->s_firstdatazone = ms->s_firstdatazone;
> > sbi->s_log_zone_size = ms->s_log_zone_size;  // ------------------>
> > set sbi->s_log_zone_size
> 
> So what you're saying is that if you construct a malicious minix image,
> you can produce undefined behaviour?  That's not something we're
> traditionally interested in, unless the filesystem is one customarily
> used for data interchange (like FAT or iso9660).

Someone had the idea what we should make these things only compile for
usermode linux.  It's kind of a hassle to copy things from UML but if
people really wanted to we could write a program to handle it.

regards,
dan carpenter