3.16.72-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Denis Efremov <efre...@ispras.ru>
commit 5635f897ed83fd539df78e98ba69ee91592f9bb8 upstream.
This fixes a global out-of-bounds read access in the next_valid_format
function of the floppy driver.
The values from autodetect field of the struct floppy_drive_params are
used as indices for the floppy_type array in the next_valid_format
function 'floppy_type[DP->autodetect[probed_format]].sect'.
To trigger the bug, one could use a value out of range and set the drive
parameters with the FDSETDRVPRM ioctl. A floppy disk is not required to
be inserted.
CAP_SYS_ADMIN is required to call FDSETDRVPRM.
The patch adds the check for values of the autodetect field to be in the
'0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array indices.
The bug was found by syzkaller.
Signed-off-by: Denis Efremov <efre...@ispras.ru>
Tested-by: Willy Tarreau <w...@1wt.eu>
Signed-off-by: Linus Torvalds <torva...@linux-foundation.org>
[bwh: Backported to 3.16: Drop changes in compat_setdrvprm(), as compat
ioctls go via fd_ioctl_locked() after translation in compat_ioctl.c.]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
---
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3383,6 +3383,20 @@ static int fd_getgeo(struct block_device
return 0;
}
+static bool valid_floppy_drive_params(const short autodetect[8])
+{
+ size_t floppy_type_size = ARRAY_SIZE(floppy_type);
+ size_t i = 0;
+
+ for (i = 0; i < 8; ++i) {
+ if (autodetect[i] < 0 ||
+ autodetect[i] >= floppy_type_size)
+ return false;
+ }
+
+ return true;
+}
+
static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned
int cmd,
unsigned long param)
{
@@ -3509,6 +3523,8 @@ static int fd_locked_ioctl(struct block_
SUPBOUND(size, strlen((const char *)outparam) + 1);
break;
case FDSETDRVPRM:
+ if (!valid_floppy_drive_params(inparam.dp.autodetect))
+ return -EINVAL;
*UDP = inparam.dp;
break;
case FDGETDRVPRM:
