Denis Efremov
1fdefbb5bc
floppy: fix out-of-bounds read in copy_buffer ...
[ Upstream commit da99466ac243f15fbba65bd261bfc75ffa1532b6 ]
This fixes a global out-of-bounds read access in the copy_buffer
function of the floppy driver.
The FDDEFPRM ioctl allows one to set the geometry of a disk. The sect
and head fields (unsigned int) of the floppy_drive structure are used to
compute the max_sector (int) in the make_raw_rw_request function. It is
possible to overflow the max_sector. Next, max_sector is passed to the
copy_buffer function and used in one of the memcpy calls.
An unprivileged user could trigger the bug if the device is accessible,
but requires a floppy disk to be inserted.
The patch adds the check for the .sect * .head multiplication for not
overflowing in the set_geometry function.
The bug was found by syzkaller.
Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-04 09:33:29 +02:00
aoe: fix crash in page count manipulation
2016-11-12 08:27:07 -07:00
drbd: skip spurious timeout (ping-timeo) when failing promote
2019-02-12 19:44:56 +01:00
Revert "mtip32xx: use runtime tag to initialize command header"
2018-04-08 12:13:01 +02:00
cdrom: do not call check_disk_change() inside cdrom_open()
2018-05-30 07:50:47 +02:00
block: convert to device_add_disk()
2016-06-27 12:26:08 -07:00
xen/blkback: don't free be structure too early
2017-07-05 14:40:20 +02:00
zram: close udev startup race condition as default groups
2018-11-27 16:09:40 +01:00
ataflop: fix error handling during setup
2018-11-13 11:16:49 -08:00
block/mm: make bdev_ops->rw_page() take a bool for read/write
2016-08-07 14:41:02 -06:00
block: convert to device_add_disk()
2016-06-27 12:26:08 -07:00
scsi: Do not set cmd_per_lun to 1 in the host template
2015-05-31 18:06:28 -07:00
block: cryptoloop - Use new skcipher interface
2016-01-27 20:35:43 +08:00
block: DAC960: print a hex number after a 0x prefix
2016-10-27 18:43:43 -07:00
floppy: fix out-of-bounds read in copy_buffer
2019-08-04 09:33:29 +02:00
cpqarray: remove it from the kernel
2016-03-14 09:06:01 -06:00
Revert "block/loop: Use global lock for ioctl() operation."
2019-05-02 09:32:04 +02:00
Revert "block/loop: Use global lock for ioctl() operation."
2019-05-02 09:32:04 +02:00
drivers:block: cpqarray clean up
2016-03-15 15:59:47 -07:00
mg_disk: fix error path in mg_probe()
2016-06-28 11:01:27 -06:00
nbd: Use set_blocksize() to set device blocksize
2019-01-23 08:10:57 +01:00
Merge branch 'for-4.9/block-irq' of git://git.kernel.dk/linux-block
2016-10-09 17:29:33 -07:00
block, drivers: add REQ_OP_FLUSH operation
2016-06-07 13:41:38 -06:00
pktcdvd: Fix pkt_setup_dev() error path
2018-02-17 13:21:19 +01:00
block: convert to device_add_disk()
2016-06-27 12:26:08 -07:00
block: convert to device_add_disk()
2016-06-27 12:26:08 -07:00
rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
2019-01-16 22:12:32 +01:00
rbd: support for exclusive-lock feature
2016-08-24 23:49:16 +02:00
skd: Submit requests to firmware before triggering the doorbell
2017-09-27 14:39:21 +02:00
sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
2019-02-12 19:44:53 +01:00
swim: fix cleanup on setup error
2018-11-13 11:16:49 -08:00
block/swim3: Fix -EBUSY error when re-opening device after unmount
2019-02-12 19:44:58 +01:00
sx8: use real time for the command seconds
2015-12-23 08:42:59 -07:00
block: rename bio bi_rw to bi_opf
2016-08-07 14:41:02 -06:00
virtio-blk: limit number of hw queues by nr_cpu_ids
2019-05-10 17:52:09 +02:00
xen/blkfront: avoid NULL blkfront_info dereference on device removal
2018-11-13 11:16:54 -08:00
xsysace: Fix error handling in ace_setup
2019-05-08 07:19:11 +02:00
1fdefbb5bc