linux-kernel - Re: [PATCH] floppy: hide invalid floppy disk types

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d3f0613c-6c3a-8efc-1c27-a6b75c34972f@gmail.com>
Date:   Sun, 8 Dec 2019 23:16:11 +0300
From:   Denis Efremov <yefremov.denis@...il.com>
To:     Moritz Müller <moritzm.mueller@...teo.de>,
        linux-kernel@...r.kernel.org, linux-block@...r.kernel.org,
        linux-kernel@...cs.fau.de
Cc:     "Philip K ." <philip@...pmail.net>
Subject: Re: [PATCH] floppy: hide invalid floppy disk types

Hi,

On 08.12.2019 22:45, Moritz Müller wrote:
> In some cases floppy disks are being indexed, even though no actual
> device exists. In our case this was caused by the CMOS-RAM having a few
> peculiar bits. This caused a non-existent floppy disk of the type 13 to
> be registered as an possibly mountable device, even though it could not
> be mounted by any user.
> 
> We believe this to be an instance of this bug, as we had similar logs
> and issues:
> 
>  https://bugzilla.kernel.org/show_bug.cgi?id=13486
>  https://bugs.launchpad.net/ubuntu/+source/linux/+bug/384579
> 
> This patch adds the option FLOPPY_ALLOW_UNKNOWN_TYPES to prevent the
> additional check that fixed the issue on our reference system, and
> increases the startup time of affected systems by over a minute.

Does driver blacklisting solves your problem? Or you have real floppy drives in
your system along with these "spurious" ones?

> 
> Co-developed-by: Philip K. <philip@...pmail.net>
> Signed-off-by: Philip K. <philip@...pmail.net>
> Signed-off-by: Moritz Müller <moritzm.mueller@...teo.de>
> ---
>  drivers/block/Kconfig  | 10 ++++++++++
>  drivers/block/floppy.c |  6 ++++++
>  2 files changed, 16 insertions(+)
> 
> diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
> index 1bb8ec575352..9e6b32c50b67 100644
> --- a/drivers/block/Kconfig
> +++ b/drivers/block/Kconfig
> @@ -72,6 +72,16 @@ config AMIGA_Z2RAM
>  	  To compile this driver as a module, choose M here: the
>  	  module will be called z2ram.
>  
> +config FLOPPY_ALLOW_UNKNOWN_TYPES
> +	bool "Allow floppy disks of unknown type to be registered."
> +	default n
> +	help
> +	  Select this option if you want the Kernel to register floppy
> +	  disks of an unknown type.
> +
> +	  This should usually not be enabled, because of cases where the
> +	  system falsely recognizes a non-existent floppy disk as mountable.
> +
>  config CDROM
>  	tristate
>  	select BLK_SCSI_REQUEST
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 485865fd0412..9439444d46d0 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -3949,7 +3949,9 @@ static void __init config_types(void)
>  			} else
>  				allowed_drive_mask &= ~(1 << drive);
>  		} else {
> +#ifdef CONFIG_FLOPPY_ALLOW_UNKNOWN_TYPES
>  			params = &default_drive_params[0].params;
> +#endif

You can't just skip it with ifdef. This will result in uninitialized
pointer dereference down the code.

		struct floppy_drive_params *params;
		...

		if (type < ARRAY_SIZE(default_drive_params)) {
			...
		} else {
#ifdef CONFIG_FLOPPY_ALLOW_UNKNOWN_TYPES
			params = &default_drive_params[0].params;
#endif
			...
		}
		...
		*UDP = *params; // << HERE

>  			snprintf(temparea, sizeof(temparea),
>  				 "unknown type %d (usb?)", type);
>  			name = temparea;
> @@ -4518,6 +4520,10 @@ static bool floppy_available(int drive)
>  		return false;
>  	if (fdc_state[FDC(drive)].version == FDC_NONE)
>  		return false;
> +#ifndef CONFIG_FLOPPY_ALLOW_UNKNOWN_TYPES
> +	if (type >= ARRAY_SIZE(default_drive_params))
> +		return false;
> +#endif
>  	return true;
>  }
>  
> 

Thanks,
Denis