[CVE-2019-14284][X/B/D][SRU][PATCH 1/1] floppy: fix div-by-zero in setup_format_params

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

[CVE-2019-14284][X/B/D][SRU][PATCH 1/1] floppy: fix div-by-zero in setup_format_params

Sultan Alsawaf
From: Denis Efremov <[hidden email]>

This fixes a divide by zero error in the setup_format_params function of
the floppy driver.

Two consecutive ioctls can trigger the bug: The first one should set the
drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
to become zero.  Next, the floppy format operation should be called.

A floppy disk is not required to be inserted.  An unprivileged user
could trigger the bug if the device is accessible.

The patch checks F_SECT_PER_TRACK for a non-zero value in the
set_geometry function.  The proper check should involve a reasonable
upper limit for the .sect and .rate fields, but it could change the
UAPI.

The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
cancels the formatting operation in case of zero.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <[hidden email]>
Tested-by: Willy Tarreau <[hidden email]>
Signed-off-by: Linus Torvalds <[hidden email]>

CVE-2019-14284

(cherry picked from commit f3554aeb991214cbfafd17d55e2bfddb50282e32)
Signed-off-by: Sultan Alsawaf <[hidden email]>
---
 drivers/block/floppy.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 2daa5b84abbc..42ae1d2d8243 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -2113,6 +2113,9 @@ static void setup_format_params(int track)
  raw_cmd->kernel_data = floppy_track_buffer;
  raw_cmd->length = 4 * F_SECT_PER_TRACK;
 
+ if (!F_SECT_PER_TRACK)
+ return;
+
  /* allow for about 30ms for data transport per track */
  head_shift = (F_SECT_PER_TRACK + 5) / 6;
 
@@ -3235,6 +3238,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
  /* sanity checking for parameters. */
  if (g->sect <= 0 ||
     g->head <= 0 ||
+    /* check for zero in F_SECT_PER_TRACK */
+    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
     g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
     /* check if reserved bits are set */
     (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
--
2.20.1


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [CVE-2019-14284][X/B/D][SRU][PATCH 1/1] floppy: fix div-by-zero in setup_format_params

Po-Hsu Lin (Sam)
Clean cherry-pick for all affected series.
Acked-by: Po-Hsu Lin <[hidden email]>

Long live the floppy.

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [CVE-2019-14284][X/B/D][SRU][PATCH 1/1] floppy: fix div-by-zero in setup_format_params

Colin Ian King-2
In reply to this post by Sultan Alsawaf
On 01/08/2019 00:43, Sultan Alsawaf wrote:

> From: Denis Efremov <[hidden email]>
>
> This fixes a divide by zero error in the setup_format_params function of
> the floppy driver.
>
> Two consecutive ioctls can trigger the bug: The first one should set the
> drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
> to become zero.  Next, the floppy format operation should be called.
>
> A floppy disk is not required to be inserted.  An unprivileged user
> could trigger the bug if the device is accessible.
>
> The patch checks F_SECT_PER_TRACK for a non-zero value in the
> set_geometry function.  The proper check should involve a reasonable
> upper limit for the .sect and .rate fields, but it could change the
> UAPI.
>
> The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
> cancels the formatting operation in case of zero.
>
> The bug was found by syzkaller.
>
> Signed-off-by: Denis Efremov <[hidden email]>
> Tested-by: Willy Tarreau <[hidden email]>
> Signed-off-by: Linus Torvalds <[hidden email]>
>
> CVE-2019-14284
>
> (cherry picked from commit f3554aeb991214cbfafd17d55e2bfddb50282e32)
> Signed-off-by: Sultan Alsawaf <[hidden email]>
> ---
>  drivers/block/floppy.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 2daa5b84abbc..42ae1d2d8243 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -2113,6 +2113,9 @@ static void setup_format_params(int track)
>   raw_cmd->kernel_data = floppy_track_buffer;
>   raw_cmd->length = 4 * F_SECT_PER_TRACK;
>  
> + if (!F_SECT_PER_TRACK)
> + return;
> +
>   /* allow for about 30ms for data transport per track */
>   head_shift = (F_SECT_PER_TRACK + 5) / 6;
>  
> @@ -3235,6 +3238,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
>   /* sanity checking for parameters. */
>   if (g->sect <= 0 ||
>      g->head <= 0 ||
> +    /* check for zero in F_SECT_PER_TRACK */
> +    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
>      g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
>      /* check if reserved bits are set */
>      (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
>
Acked-by: Colin Ian King <[hidden email]>

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

APPLIED: [CVE-2019-14284][X/B/D][SRU][PATCH 1/1] floppy: fix div-by-zero in setup_format_params

Khaled Elmously
In reply to this post by Sultan Alsawaf
On 2019-07-31 16:43:09 , Sultan Alsawaf wrote:

> From: Denis Efremov <[hidden email]>
>
> This fixes a divide by zero error in the setup_format_params function of
> the floppy driver.
>
> Two consecutive ioctls can trigger the bug: The first one should set the
> drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
> to become zero.  Next, the floppy format operation should be called.
>
> A floppy disk is not required to be inserted.  An unprivileged user
> could trigger the bug if the device is accessible.
>
> The patch checks F_SECT_PER_TRACK for a non-zero value in the
> set_geometry function.  The proper check should involve a reasonable
> upper limit for the .sect and .rate fields, but it could change the
> UAPI.
>
> The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
> cancels the formatting operation in case of zero.
>
> The bug was found by syzkaller.
>
> Signed-off-by: Denis Efremov <[hidden email]>
> Tested-by: Willy Tarreau <[hidden email]>
> Signed-off-by: Linus Torvalds <[hidden email]>
>
> CVE-2019-14284
>
> (cherry picked from commit f3554aeb991214cbfafd17d55e2bfddb50282e32)
> Signed-off-by: Sultan Alsawaf <[hidden email]>
> ---
>  drivers/block/floppy.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 2daa5b84abbc..42ae1d2d8243 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -2113,6 +2113,9 @@ static void setup_format_params(int track)
>   raw_cmd->kernel_data = floppy_track_buffer;
>   raw_cmd->length = 4 * F_SECT_PER_TRACK;
>  
> + if (!F_SECT_PER_TRACK)
> + return;
> +
>   /* allow for about 30ms for data transport per track */
>   head_shift = (F_SECT_PER_TRACK + 5) / 6;
>  
> @@ -3235,6 +3238,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
>   /* sanity checking for parameters. */
>   if (g->sect <= 0 ||
>      g->head <= 0 ||
> +    /* check for zero in F_SECT_PER_TRACK */
> +    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
>      g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
>      /* check if reserved bits are set */
>      (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
> --
> 2.20.1
>
>
> --
> kernel-team mailing list
> [hidden email]
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team