Piteball/android_kernel_samsung_msm8226
1
0
Fork 0
mirror of https://github.com/S3NEO/android_kernel_samsung_msm8226.git synced 2024-11-07 03:47:13 +00:00
Code Issues Projects Releases Packages Wiki Activity

floppy: fix out-of-bounds read in copy_buffer

Browse source 
commit da99466ac243f15fbba65bd261bfc75ffa1532b6 upstream.

This fixes a global out-of-bounds read access in the copy_buffer
function of the floppy driver.

The FDDEFPRM ioctl allows one to set the geometry of a disk.  The sect
and head fields (unsigned int) of the floppy_drive structure are used to
compute the max_sector (int) in the make_raw_rw_request function.  It is
possible to overflow the max_sector.  Next, max_sector is passed to the
copy_buffer function and used in one of the memcpy calls.

An unprivileged user could trigger the bug if the device is accessible,
but requires a floppy disk to be inserted.

The patch adds the check for the .sect * .head multiplication for not
overflowing in the set_geometry function.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2019-14283
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: Idb3e900d17920e6339b862419018f4740a7d4caf
This commit is contained in:
Denis Efremov 2019-07-12 21:55:23 +03:00 committed by matteo0026
parent 27893455f4
commit 5e8174e74d
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/block/floppy.c
View file

@ -3224,8 +3224,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
int cnt; int cnt;
/* sanity checking for parameters. */ /* sanity checking for parameters. */
if (g->sect <= 0 || if ((int)g->sect <= 0 ||
g->head <= 0 || (int)g->head <= 0 ||
/* check for overflow in max_sector */
(int)(g->sect * g->head) <= 0 ||
g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) || g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
/* check if reserved bits are set */ /* check if reserved bits are set */
(g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0) (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)