From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753266AbeEGUuG (ORCPT ); Mon, 7 May 2018 16:50:06 -0400 Received: from mail-pl0-f53.google.com ([209.85.160.53]:42314 "EHLO mail-pl0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752934AbeEGUuE (ORCPT ); Mon, 7 May 2018 16:50:04 -0400 X-Google-Smtp-Source: AB8JxZohu2zId+/NaxUxmG4aOgxQ83w3JTnquCdzfORnTqjj2n2HzngMP7AyoMpLFp4Rz+Zs5Zc0MtQ77lXzs4qNp70= MIME-Version: 1.0 In-Reply-To: <4217788.NhxQeTpgEt@merkaba> References: <20180425154602.GA8546@bombadil.infradead.org> <20180507021554.GN30522@ZenIV.linux.org.uk> <4217788.NhxQeTpgEt@merkaba> From: Michael Schmitz Date: Tue, 8 May 2018 08:50:03 +1200 Message-ID: Subject: Re: moving affs + RDB partition support to staging? To: Martin Steigerwald Cc: Al Viro , John Paul Adrian Glaubitz , Matthew Wilcox , David Sterba , Linux FS Devel , Linux Kernel Development , Jens Axboe , "Linux/m68k" , Debian m68k Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Martin, On Mon, May 7, 2018 at 7:08 PM, Martin Steigerwald wrote: > Michael Schmitz - 07.05.18, 04:40: >> Al, >> >> I don't think there is USB sticks with affs on them as yet. There >> isn't even USB host controller support for Amiga hardware (yet). >> >> Last I tried USB on m68k (Atari, 060 accelerator) the desktop >> experience was such that I'd rather not repeat that in a hurry (and >> that was a simple FAT USB stick). > > There is USB support available on Amiga since a long time. Good to hear that. I stand corrected. > On "Classic" Amigas AmigaOS 3.x with Poseidon USB stack + some USB card. Haven't seen a Linux driver for that 'some USB card' yet. > On AmigaOS 4.x built-in. AmigaOS 4.x hardware like Sam boards from Acube > Systems have USB controllers that work out of the bux. Forgot about the new (non-m68k) hardware. My focus is somewhat narrow, on m68k and Linux. > And I am pretty sure, you can also tell it to use Amiga Fast Filesystem > (on Linux affs) on an USB stick. Also you can plug in an external > harddisk with RDB partitions and whatever filesystems you wish. I already conceded that's possible. So our problem with the bug Al spotted, and AFFS on USB media are twtofold: AmigaOS: Exploitable: yes (unless the AmigaOS AFFS driver detects and mitigates this). Likelihood: low (as Joanne said there are easier ways to do harm to these systems) Linux: Exploitable: yes, except on hardware that doesn't have USB hardware support. Likelihood: high Can we blacklist affs from being autoloaded through udev on USB storage media discovery? Cheers, Michael From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl0-f53.google.com ([209.85.160.53]:42314 "EHLO mail-pl0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752934AbeEGUuE (ORCPT ); Mon, 7 May 2018 16:50:04 -0400 MIME-Version: 1.0 In-Reply-To: <4217788.NhxQeTpgEt@merkaba> References: <20180425154602.GA8546@bombadil.infradead.org> <20180507021554.GN30522@ZenIV.linux.org.uk> <4217788.NhxQeTpgEt@merkaba> From: Michael Schmitz Date: Tue, 8 May 2018 08:50:03 +1200 Message-ID: Subject: Re: moving affs + RDB partition support to staging? To: Martin Steigerwald Cc: Al Viro , John Paul Adrian Glaubitz , Matthew Wilcox , David Sterba , Linux FS Devel , Linux Kernel Development , Jens Axboe , "Linux/m68k" , Debian m68k Content-Type: text/plain; charset="UTF-8" Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Martin, On Mon, May 7, 2018 at 7:08 PM, Martin Steigerwald wrote: > Michael Schmitz - 07.05.18, 04:40: >> Al, >> >> I don't think there is USB sticks with affs on them as yet. There >> isn't even USB host controller support for Amiga hardware (yet). >> >> Last I tried USB on m68k (Atari, 060 accelerator) the desktop >> experience was such that I'd rather not repeat that in a hurry (and >> that was a simple FAT USB stick). > > There is USB support available on Amiga since a long time. Good to hear that. I stand corrected. > On "Classic" Amigas AmigaOS 3.x with Poseidon USB stack + some USB card. Haven't seen a Linux driver for that 'some USB card' yet. > On AmigaOS 4.x built-in. AmigaOS 4.x hardware like Sam boards from Acube > Systems have USB controllers that work out of the bux. Forgot about the new (non-m68k) hardware. My focus is somewhat narrow, on m68k and Linux. > And I am pretty sure, you can also tell it to use Amiga Fast Filesystem > (on Linux affs) on an USB stick. Also you can plug in an external > harddisk with RDB partitions and whatever filesystems you wish. I already conceded that's possible. So our problem with the bug Al spotted, and AFFS on USB media are twtofold: AmigaOS: Exploitable: yes (unless the AmigaOS AFFS driver detects and mitigates this). Likelihood: low (as Joanne said there are easier ways to do harm to these systems) Linux: Exploitable: yes, except on hardware that doesn't have USB hardware support. Likelihood: high Can we blacklist affs from being autoloaded through udev on USB storage media discovery? Cheers, Michael