lkml.org 
[lkml]   [2020]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()
    Date
    UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45
    index 16 is out of range for type 'unsigned char [16]'
    Call Trace:
    ...
    setup_rw_floppy+0x5c3/0x7f0
    floppy_ready+0x2be/0x13b0
    process_one_work+0x2c1/0x5d0
    worker_thread+0x56/0x5e0
    kthread+0x122/0x170
    ret_from_fork+0x35/0x40

    From include/uapi/linux/fd.h:
    struct floppy_raw_cmd {
    ...
    unsigned char cmd_count;
    unsigned char cmd[16];
    unsigned char reply_count;
    unsigned char reply[16];
    ...
    }

    This out-of-bounds access is intentional. The command in struct
    floppy_raw_cmd may take up the space initially intended for the reply
    and the reply count. It is needed for long 82078 commands such as
    RESTORE, which takes 17 command bytes. Initial cmd size is not enough
    and since struct setup_rw_floppy is a part of uapi we check that
    cmd_count is in [0:16+1+16] in raw_cmd_copyin().

    The patch replaces array subscript with pointer arithetic to suppress
    UBSAN warning.

    Signed-off-by: Denis Efremov <efremov@linux.com>
    ---
    drivers/block/floppy.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
    index 2169df796d18..63981b1f8d4c 100644
    --- a/drivers/block/floppy.c
    +++ b/drivers/block/floppy.c
    @@ -1518,7 +1518,10 @@ static void setup_rw_floppy(void)

    r = 0;
    for (i = 0; i < raw_cmd->cmd_count; i++)
    - r |= output_byte(current_fdc, raw_cmd->cmd[i]);
    + /* The command may take up the space initially intended for the
    + * reply and the reply count.
    + */
    + r |= output_byte(current_fdc, *(raw_cmd->cmd + i));

    debugt(__func__, "rw_command");

    --
    2.25.3
    \
     
     \ /
      Last update: 2020-04-21 14:58    [W:2.435 / U:0.312 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site