lkml.org 
[lkml]   [2019]   [Aug]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 140/157] floppy: fix invalid pointer dereference in drive_name
    3.16.72-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Denis Efremov <efremov@ispras.ru>

    commit 9b04609b784027968348796a18f601aed9db3789 upstream.

    This fixes the invalid pointer dereference in the drive_name function of
    the floppy driver.

    The native_format field of the struct floppy_drive_params is used as
    floppy_type array index in the drive_name function. Thus, the field
    should be checked the same way as the autodetect field.

    To trigger the bug, one could use a value out of range and set the drive
    parameters with the FDSETDRVPRM ioctl. Next, FDGETDRVTYP ioctl should
    be used to call the drive_name. A floppy disk is not required to be
    inserted.

    CAP_SYS_ADMIN is required to call FDSETDRVPRM.

    The patch adds the check for a value of the native_format field to be in
    the '0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array
    indices.

    The bug was found by syzkaller.

    Signed-off-by: Denis Efremov <efremov@ispras.ru>
    Tested-by: Willy Tarreau <w@1wt.eu>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.16: Drop changes in compat_setdrvprm(), as compat
    ioctls go via fd_ioctl_locked() after translation in compat_ioctl.c.]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    --- a/drivers/block/floppy.c
    +++ b/drivers/block/floppy.c
    @@ -3383,7 +3383,8 @@ static int fd_getgeo(struct block_device
    return 0;
    }

    -static bool valid_floppy_drive_params(const short autodetect[8])
    +static bool valid_floppy_drive_params(const short autodetect[8],
    + int native_format)
    {
    size_t floppy_type_size = ARRAY_SIZE(floppy_type);
    size_t i = 0;
    @@ -3394,6 +3395,9 @@ static bool valid_floppy_drive_params(co
    return false;
    }

    + if (native_format < 0 || native_format >= floppy_type_size)
    + return false;
    +
    return true;
    }

    @@ -3523,7 +3527,8 @@ static int fd_locked_ioctl(struct block_
    SUPBOUND(size, strlen((const char *)outparam) + 1);
    break;
    case FDSETDRVPRM:
    - if (!valid_floppy_drive_params(inparam.dp.autodetect))
    + if (!valid_floppy_drive_params(inparam.dp.autodetect,
    + inparam.dp.native_format))
    return -EINVAL;
    *UDP = inparam.dp;
    break;
    \
     
     \ /
      Last update: 2019-08-10 22:45    [W:3.987 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site