Skip to content

Commit f3554ae

Browse files
evdenistorvalds
authored andcommitted
floppy: fix div-by-zero in setup_format_params
This fixes a divide by zero error in the setup_format_params function of the floppy driver. Two consecutive ioctls can trigger the bug: The first one should set the drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK to become zero. Next, the floppy format operation should be called. A floppy disk is not required to be inserted. An unprivileged user could trigger the bug if the device is accessible. The patch checks F_SECT_PER_TRACK for a non-zero value in the set_geometry function. The proper check should involve a reasonable upper limit for the .sect and .rate fields, but it could change the UAPI. The patch also checks F_SECT_PER_TRACK in the setup_format_params, and cancels the formatting operation in case of zero. The bug was found by syzkaller. Signed-off-by: Denis Efremov <efremov@ispras.ru> Tested-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 0ecfebd commit f3554ae

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

Diff for: drivers/block/floppy.c

+5
Original file line numberDiff line numberDiff line change
@@ -2120,6 +2120,9 @@ static void setup_format_params(int track)
21202120
raw_cmd->kernel_data = floppy_track_buffer;
21212121
raw_cmd->length = 4 * F_SECT_PER_TRACK;
21222122

2123+
if (!F_SECT_PER_TRACK)
2124+
return;
2125+
21232126
/* allow for about 30ms for data transport per track */
21242127
head_shift = (F_SECT_PER_TRACK + 5) / 6;
21252128

@@ -3232,6 +3235,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
32323235
/* sanity checking for parameters. */
32333236
if (g->sect <= 0 ||
32343237
g->head <= 0 ||
3238+
/* check for zero in F_SECT_PER_TRACK */
3239+
(unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
32353240
g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
32363241
/* check if reserved bits are set */
32373242
(g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)

0 commit comments

Comments
 (0)