summaryrefslogtreecommitdiffstats
path: root/drivers/block
diff options
context:
space:
mode:
authorDenis Efremov <efremov@ispras.ru>2019-07-12 21:55:23 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2019-07-17 14:45:50 -0700
commitda99466ac243f15fbba65bd261bfc75ffa1532b6 (patch)
treea4078e6242803b3e1e5dd294fa0ad5fa52f4f9a3 /drivers/block
parent9b04609b784027968348796a18f601aed9db3789 (diff)
downloadlinux-da99466ac243f15fbba65bd261bfc75ffa1532b6.tar.gz
linux-da99466ac243f15fbba65bd261bfc75ffa1532b6.tar.bz2
linux-da99466ac243f15fbba65bd261bfc75ffa1532b6.zip
floppy: fix out-of-bounds read in copy_buffer
This fixes a global out-of-bounds read access in the copy_buffer function of the floppy driver. The FDDEFPRM ioctl allows one to set the geometry of a disk. The sect and head fields (unsigned int) of the floppy_drive structure are used to compute the max_sector (int) in the make_raw_rw_request function. It is possible to overflow the max_sector. Next, max_sector is passed to the copy_buffer function and used in one of the memcpy calls. An unprivileged user could trigger the bug if the device is accessible, but requires a floppy disk to be inserted. The patch adds the check for the .sect * .head multiplication for not overflowing in the set_geometry function. The bug was found by syzkaller. Signed-off-by: Denis Efremov <efremov@ispras.ru> Tested-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/block')
-rw-r--r--drivers/block/floppy.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 671a0ae434b4..fee57f7f3821 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3233,8 +3233,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
int cnt;
/* sanity checking for parameters. */
- if (g->sect <= 0 ||
- g->head <= 0 ||
+ if ((int)g->sect <= 0 ||
+ (int)g->head <= 0 ||
+ /* check for overflow in max_sector */
+ (int)(g->sect * g->head) <= 0 ||
/* check for zero in F_SECT_PER_TRACK */
(unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||