56 lines
2.0 KiB
Diff
56 lines
2.0 KiB
Diff
From: Denis Efremov <efremov@ispras.ru>
|
|
Date: Fri, 12 Jul 2019 21:55:23 +0300
|
|
Subject: floppy: fix out-of-bounds read in copy_buffer
|
|
Origin: https://git.kernel.org/linus/da99466ac243f15fbba65bd261bfc75ffa1532b6
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-14283
|
|
|
|
[ Upstream commit da99466ac243f15fbba65bd261bfc75ffa1532b6 ]
|
|
|
|
This fixes a global out-of-bounds read access in the copy_buffer
|
|
function of the floppy driver.
|
|
|
|
The FDDEFPRM ioctl allows one to set the geometry of a disk. The sect
|
|
and head fields (unsigned int) of the floppy_drive structure are used to
|
|
compute the max_sector (int) in the make_raw_rw_request function. It is
|
|
possible to overflow the max_sector. Next, max_sector is passed to the
|
|
copy_buffer function and used in one of the memcpy calls.
|
|
|
|
An unprivileged user could trigger the bug if the device is accessible,
|
|
but requires a floppy disk to be inserted.
|
|
|
|
The patch adds the check for the .sect * .head multiplication for not
|
|
overflowing in the set_geometry function.
|
|
|
|
The bug was found by syzkaller.
|
|
|
|
Signed-off-by: Denis Efremov <efremov@ispras.ru>
|
|
Tested-by: Willy Tarreau <w@1wt.eu>
|
|
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
---
|
|
drivers/block/floppy.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
(limited to 'drivers/block/floppy.c')
|
|
|
|
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
|
|
index 8d69a8af8b78..4a9a4d12721a 100644
|
|
--- a/drivers/block/floppy.c
|
|
+++ b/drivers/block/floppy.c
|
|
@@ -3244,8 +3244,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
|
|
int cnt;
|
|
|
|
/* sanity checking for parameters. */
|
|
- if (g->sect <= 0 ||
|
|
- g->head <= 0 ||
|
|
+ if ((int)g->sect <= 0 ||
|
|
+ (int)g->head <= 0 ||
|
|
+ /* check for overflow in max_sector */
|
|
+ (int)(g->sect * g->head) <= 0 ||
|
|
/* check for zero in F_SECT_PER_TRACK */
|
|
(unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
|
|
g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
|
|
--
|
|
cgit 1.2-0.3.lf.el7
|
|
|