Back when I was poking around with filesystem fuzzing stuff years back, I noticed something odd:

An EXT filesystem can tell the Linux OS how it should behave "if" the filesystem is corrupt, including triggering a kernel panic. In a world where USB thumb drives exist, this seems... not ideal.

Let's see what happens if we plug such a mass storage device into a fully patched Chromebook in 2024...

Oh.

The man page for tune2fs is pretty clear about this capability.

The person who writes the data to the USB mass storage device can specify that both:
1) The OS that reads the device should panic if the filesystem has an error.
2) The filesystem has an error.

๐Ÿคฆโ€โ™‚๏ธ

Modern Linux distros aren't really affected by this. At least in a drive-by sense. Auto-mounting is handled in a safer way than simply telling the kernel to mount the filesystem you just plugged in.

For example, compare the Ubuntu 22.04 behavior (complain that the filesystem is corrupt) vs. Ubuntu 20.04 (panic and reboot). For modern Linux to see the panic, you'd have to manually mount the filesystem (as root/sudo).

ChromeOS, on the other hand, chooses the more YOLO route of auto-mounting via the kernel.

@wdormann Yes, it was patched in udev rules fairly recently. AFAIK in Fedora if the file system is corrupted it gets mounted as read-only and the user gets a message about the problem.
@wdormann How do I replicate this? Preferably in a way such that at first the system mounts the drive thinking it's safe, but then the panic occurs upon trying to list the root directory, for example?

@sanfierro
Whether the kernel crash requires user interaction such as browsing depends on the OS, filesystem, and the type of corruption that has happened. But yeah, when I did the work one of the NTFS corruptions I encountered would panic macOS only when a directory was browsed to, as opposed to at mount time.

I did this about 5 years ago, so aside from me testing this one output on ChromeOS, I haven't really revisited it to see what works against modern OSes.

There's a slide deck about what I did here:
https://insights.sei.cmu.edu/library/death-by-thumb-drive/

Or if you want to hear yours truly walk through it ๐Ÿ˜‚:
https://www.youtube.com/watch?v=8nZlfi578XM

Death by Thumb Drive

In this talk, Will Dormann discusses how to use CERT BFF to fuzz filesystems, and how to analyze kernel-level crashes.

SEI Digital Library
@wdormann I just changed the fstab entry for my /boot partition, as that one's not encrypted and could be used by someone with physical access to send my machine into a boot loop, maybe.
@cm
We'll, they'd need to be on your computer as root to mess with your /boot.
And if an attacker has that level of access, they can do whatever they want. ๐Ÿ˜€
@wdormann An "evil maid" type attack would suffice, I run encrypted filesystems except for /boot, and this attack might be a denial of service even with secure boot activated. Once you know what's happening it's easily fixed with a linux live CD, but I guess you could confuse the heck out of even seasoned linux admins...
@wdormann How does Android deal with this? Could this help with jailbreaking Smart-TVs / media-boxes?
@indigoamber
I don't think that Android supports the EXT filesystem family.
Even if it did, a kernel panic helps nobody here.

@wdormann weirdly enough, I foresaw the "logic flaw" due to weird issues with VMs and moving disks around where the policy of the source would affect the destination

I just forgot that "cause a kernel panic" was an option instead of "fail to mount/lazy unmount"

@wdormann so it's behaving exactly as it should?
@Kurt
Yes, this is behavior as designed.

@wdormann I thought that is only for errors during operationโ€ฆ

โ€ฆ let me guess, the OS is trying to access things on the fs to do things like provide icons and stats?

@mirabilos
The OS can tell at mount point if something is wrong (depending on what specifically is wrong)
@wdormann yes, but then it just refuses to mount, or at least ought to
@mirabilos
Not by design here.
If Linux detects that something is wrong with the filesystem, it may panic. Depending on what said filesystem tells it that it should do.
@wdormann what does tytso have to say to this, if any?
@wdormann dies that mean unless the device is removed (or fixed by fsck on boot), the system will be stuck on a reboot -> kernel panic loop, or does it only work like that on first plugin?
@4censord
ChromeOS only auto-mounts filesystems after login. So at least by default, it will not boot loop. It will merely reboot to the log-in screen.

@wdormann I can even see the use case for such a feature - if filesystem integrity is more critical than availability

but honestly, I see very little use case for a desktop operating system respecting -e panic, and almost no use case for anything to respect it on removable media unless explicitly opted into by the user - fall back to -e remount-ro or unmount it IMO, but not a panic.

@bhtooefr
Indeed. It could make sense in a world where external storage is not a thing, and therefore it's the system admin who has control of the behavior.

But where the rando who last wrote to a USB device can decide how YOUR computer should behave when it's plugged in? That ain't right...

@wdormann is this only on mount? Or is this just when the OS detects the device exists ?
@quixoticgeek
It happens during the mount process. Which ChromeOS does automatically upon inserting a USB mass storage device into a logged-in system.
@wdormann so as long as automount is disabled, you can at least stop someone rebooting your device by plugging in ?
@wdormann ext filesystems also have file ownership, suid capability, etc. The worst of this can be mitigated with mount options (maybe panic on error can too?) but ultimately it's not a suitable fs for external media and should not be auto mounted by anything unless you have a sandboxed FUSE driver for it in place of the kernel one.
@wdormann Indeed, -o errors=continue fixes this. ChromeOS is being bad automounting ext fs on external media without it. Same as mounting without -o nosuid would be a bug.

I remember testing that feature before I had a computer with USB. It also works with floppies.

There is a mount option which can override that behavior. If that mount option is specified the value specified on the file system itself has no effect.

It's a questionable feature. I think it would make sense to remove the ability to specify it on the file system. Having the mount option makes some kind of sense.

@wdormann Why do I see Clippy here? "Are you trying to cause a kernel panic? I can help!"
@wdormann It seems this feature is located in the wrong place -- /etc/fstab seems more appropriate place for flags like these.

@wdormann damn. I was waiting for the video to loop or precisely: the notebook stay in a panic-reboot-loop. Some minutes later: Chrome OS isnt rebooting that slowly, right?...

... no. The video just stopped. Feels like bamboozled on 9gag.

@d33pjs @wdormann the chromebook only automounts when the user is sigbed in, it will kernpanic-->restart-->login-->repeat
@wdormann Ah, thatโ€™s how you turn off a Chromebook! ๐Ÿ˜‰
@wdormann if you have physical access to usb you can reboot or damage anyway (just short-circuit, etc.)
@wdormann What else can we tell it to do? ๐Ÿ‘€
@wdormann While the security implications are bad, the practical joke implications are amazing. Right up there with palming a small neodymium magnet to trigger the lid sensor on coworkers' laptops.
@ieure @wdormann my secret magic trick. I have a magnetic implant in my finger
@wdormann does it boot loop on its own as long as plugged in?

@ferrix
This particular machine will display a login prompt when it first turns on, at which point it's fine.

I suppose if it auto logged on, it would be in a reboot loop.

@wdormann Interesting, out of curiosity: Does the device get to do this just by being plugged in, or does this require it to be mounted first (or some other setup and ChromeOS is just configured to do the required setup automatically)?
I would assume it is not being mounted automatically so the device really just gets to do this? That does indeed seem ... suboptimal
Though presumably preventable through some kind of udev config if one were willing to hinder general USB functionality?
@yahwon
It's the mounting of the FS that does it. Chrome OS does this automatically when you plug it in.

@wdormann ZFS also provides a pool parameter for failmode:

failmode=wait | continue | panic

Less risk though, because USB zpools aren't automounted.

@wdormann Is something in the GUI trying to auto mount the filesystem? I wouldn't expect the kernel to do much more than read the partition table when a device is plugged in.
@diffrentcolours
ChromeOS mounts filesystems automatically when USB mass storage devices are plugged in.
@wdormann Well, turns out "fuchsia isn't linux" is a lie.
@BalooUriza
This is ChromeOS. Not Fuschia.
@wdormann Doh, apparently I extrapolated from previous fuschia knowledge and reality didn't go that way. Oops.

@wdormann

Hilarious but correct.

The system doesn't know that /dev/sda1 is less important than /dev/nv0sl0p9n3g3g5g4g3

I suppose you might not require a panic from a device that was not booted from but even then, you have to decide what you booted from (safely)!

@wdormann I wonder if flight entertainment systems mount the drive if you plug it in?
@wdormann owwwh! Does macOS behave the same?
@ConanChiles
macOS doesn't support the EXT filesystem.
@wdormann I always had the impression that Linux loves throwing a good kernel panic tantrum just because. ๐Ÿ˜

@wdormann

That seems less than optimal ๐Ÿ˜•๐Ÿคฆโ€โ™‚๏ธ

@wdormann the video buffered at exactly the moment you plugged it in
@wdormann dang, thank god I chose xfs. Rock solid, survives force-shutdowns (my laptop has one nasty bug that i have no idea how to troubleshoot), just perfect
@wdormann given that some devices will boot from USB if present, would it be possible to make a stick which causes the OS to panic, but the UEFI to mount & run?
@Edent @wdormann Not terribly usefully on anything with secure boot