summaryrefslogtreecommitdiffstats
path: root/drivers/block/floppy.c
diff options
context:
space:
mode:
authorDenis Efremov <efremov@linux.com>2020-05-01 15:44:16 +0200
committerDenis Efremov <efremov@linux.com>2020-05-12 18:34:57 +0200
commit0836275df4db20daf040fff5d9a1da89c4c08a85 (patch)
treeb88e4e8e74da74f0e32d5c927631c23a7396c322 /drivers/block/floppy.c
parentfloppy: add defines for sizes of cmd & reply buffers of floppy_raw_cmd (diff)
downloadlinux-0836275df4db20daf040fff5d9a1da89c4c08a85.tar.xz
linux-0836275df4db20daf040fff5d9a1da89c4c08a85.zip
floppy: suppress UBSAN warning in setup_rw_floppy()
UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45 index 16 is out of range for type 'unsigned char [16]' Call Trace: ... setup_rw_floppy+0x5c3/0x7f0 floppy_ready+0x2be/0x13b0 process_one_work+0x2c1/0x5d0 worker_thread+0x56/0x5e0 kthread+0x122/0x170 ret_from_fork+0x35/0x40 From include/uapi/linux/fd.h: struct floppy_raw_cmd { ... unsigned char cmd_count; unsigned char cmd[16]; unsigned char reply_count; unsigned char reply[16]; ... } This out-of-bounds access is intentional. The command in struct floppy_raw_cmd may take up the space initially intended for the reply and the reply count. It is needed for long 82078 commands such as RESTORE, which takes 17 command bytes. Initial cmd size is not enough and since struct setup_rw_floppy is a part of uapi we check that cmd_count is in [0:16+1+16] in raw_cmd_copyin(). The patch adds union with original cmd,reply_count,reply fields and fullcmd field of equivalent size. The cmd accesses are turned to fullcmd where appropriate to suppress UBSAN warning. Link: https://lore.kernel.org/r/20200501134416.72248-5-efremov@linux.com Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Denis Efremov <efremov@linux.com>
Diffstat (limited to 'drivers/block/floppy.c')
-rw-r--r--drivers/block/floppy.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9e098d53b046..064c1acb9f00 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -1070,7 +1070,7 @@ static void setup_DMA(void)
if (raw_cmd->length == 0) {
print_hex_dump(KERN_INFO, "zero dma transfer size: ",
DUMP_PREFIX_NONE, 16, 1,
- raw_cmd->cmd, raw_cmd->cmd_count, false);
+ raw_cmd->fullcmd, raw_cmd->cmd_count, false);
cont->done(0);
fdc_state[current_fdc].reset = 1;
return;
@@ -1515,7 +1515,7 @@ static void setup_rw_floppy(void)
r = 0;
for (i = 0; i < raw_cmd->cmd_count; i++)
- r |= output_byte(current_fdc, raw_cmd->cmd[i]);
+ r |= output_byte(current_fdc, raw_cmd->fullcmd[i]);
debugt(__func__, "rw_command");