Skip to content

Commit da99466

Browse files
evdenistorvalds
authored andcommitted
floppy: fix out-of-bounds read in copy_buffer
This fixes a global out-of-bounds read access in the copy_buffer function of the floppy driver. The FDDEFPRM ioctl allows one to set the geometry of a disk. The sect and head fields (unsigned int) of the floppy_drive structure are used to compute the max_sector (int) in the make_raw_rw_request function. It is possible to overflow the max_sector. Next, max_sector is passed to the copy_buffer function and used in one of the memcpy calls. An unprivileged user could trigger the bug if the device is accessible, but requires a floppy disk to be inserted. The patch adds the check for the .sect * .head multiplication for not overflowing in the set_geometry function. The bug was found by syzkaller. Signed-off-by: Denis Efremov <efremov@ispras.ru> Tested-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 9b04609 commit da99466

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

Diff for: drivers/block/floppy.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -3233,8 +3233,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
32333233
int cnt;
32343234

32353235
/* sanity checking for parameters. */
3236-
if (g->sect <= 0 ||
3237-
g->head <= 0 ||
3236+
if ((int)g->sect <= 0 ||
3237+
(int)g->head <= 0 ||
3238+
/* check for overflow in max_sector */
3239+
(int)(g->sect * g->head) <= 0 ||
32383240
/* check for zero in F_SECT_PER_TRACK */
32393241
(unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
32403242
g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||

0 commit comments

Comments
 (0)