diff options
| author | Denis Efremov <efremov@ispras.ru> | 2019-07-12 21:55:20 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-08-13 12:39:26 +0100 |
| commit | a36b6459cbff32a0ef228241c99d6586ca7e944c (patch) | |
| tree | 53180d95a3a536b0a70a05a94be1dbb20195dd47 | |
| parent | 929606ae749185c940a5476d3a0e8d8e7c9c1db6 (diff) | |
floppy: fix div-by-zero in setup_format_params
commit f3554aeb991214cbfafd17d55e2bfddb50282e32 upstream.
This fixes a divide by zero error in the setup_format_params function of
the floppy driver.
Two consecutive ioctls can trigger the bug: The first one should set the
drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
to become zero. Next, the floppy format operation should be called.
A floppy disk is not required to be inserted. An unprivileged user
could trigger the bug if the device is accessible.
The patch checks F_SECT_PER_TRACK for a non-zero value in the
set_geometry function. The proper check should involve a reasonable
upper limit for the .sect and .rate fields, but it could change the
UAPI.
The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
cancels the formatting operation in case of zero.
The bug was found by syzkaller.
Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/block/floppy.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index df51673d6591..5dd5f49b35ad 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -2113,6 +2113,9 @@ static void setup_format_params(int track) raw_cmd->kernel_data = floppy_track_buffer; raw_cmd->length = 4 * F_SECT_PER_TRACK; + if (!F_SECT_PER_TRACK) + return; + /* allow for about 30ms for data transport per track */ head_shift = (F_SECT_PER_TRACK + 5) / 6; @@ -3235,6 +3238,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g, /* sanity checking for parameters. */ if (g->sect <= 0 || g->head <= 0 || + /* check for zero in F_SECT_PER_TRACK */ + (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) || /* check if reserved bits are set */ (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0) |