Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b565f32 authored by Denis Efremov's avatar Denis Efremov Committed by Greg Kroah-Hartman
Browse files

floppy: fix out-of-bounds read in next_valid_format 



[ Upstream commit 5635f897ed83fd539df78e98ba69ee91592f9bb8 ]

This fixes a global out-of-bounds read access in the next_valid_format
function of the floppy driver.

The values from autodetect field of the struct floppy_drive_params are
used as indices for the floppy_type array in the next_valid_format
function 'floppy_type[DP->autodetect[probed_format]].sect'.

To trigger the bug, one could use a value out of range and set the drive
parameters with the FDSETDRVPRM ioctl.  A floppy disk is not required to
be inserted.

CAP_SYS_ADMIN is required to call FDSETDRVPRM.

The patch adds the check for values of the autodetect field to be in the
'0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array indices.

The bug was found by syzkaller.

Signed-off-by: default avatarDenis Efremov <efremov@ispras.ru>
Tested-by: default avatarWilly Tarreau <w@1wt.eu>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 6e34fd07

drivers/block/floppy.c

+18 −0
Original line number Original line Diff line number Diff line
@@ -3391,6 +3391,20 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo) 
	return 0;

	return 0;

}

}





static bool valid_floppy_drive_params(const short autodetect[8])

{

	size_t floppy_type_size = ARRAY_SIZE(floppy_type);

	size_t i = 0;



	for (i = 0; i < 8; ++i) {

		if (autodetect[i] < 0 ||

		    autodetect[i] >= floppy_type_size)

			return false;

	}



	return true;

}



static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,

static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,

		    unsigned long param)

		    unsigned long param)

{

{
@@ -3517,6 +3531,8 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int 
		SUPBOUND(size, strlen((const char *)outparam) + 1);

		SUPBOUND(size, strlen((const char *)outparam) + 1);

		break;

		break;

	case FDSETDRVPRM:

	case FDSETDRVPRM:

		if (!valid_floppy_drive_params(inparam.dp.autodetect))

			return -EINVAL;

		*UDP = inparam.dp;

		*UDP = inparam.dp;

		break;

		break;

	case FDGETDRVPRM:

	case FDGETDRVPRM:
@@ -3714,6 +3730,8 @@ static int compat_setdrvprm(int drive, 
		return -EPERM;

		return -EPERM;

	if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params)))

	if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params)))

		return -EFAULT;

		return -EFAULT;

	if (!valid_floppy_drive_params(v.autodetect))

		return -EINVAL;

	mutex_lock(&floppy_mutex);

	mutex_lock(&floppy_mutex);

	UDP->cmos = v.cmos;

	UDP->cmos = v.cmos;

	UDP->max_dtr = v.max_dtr;

	UDP->max_dtr = v.max_dtr;