APPLIED: [CVE-2019-14284][X/B/D][SRU][PATCH 1/1] floppy: fix div-by-zero in setup_format_params

[Khaled Elmously]

On 2019-07-31 16:43:09 , Sultan Alsawaf wrote:
> From: Denis Efremov <efremov at ispras.ru>
> 
> This fixes a divide by zero error in the setup_format_params function of
> the floppy driver.
> 
> Two consecutive ioctls can trigger the bug: The first one should set the
> drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
> to become zero.  Next, the floppy format operation should be called.
> 
> A floppy disk is not required to be inserted.  An unprivileged user
> could trigger the bug if the device is accessible.
> 
> The patch checks F_SECT_PER_TRACK for a non-zero value in the
> set_geometry function.  The proper check should involve a reasonable
> upper limit for the .sect and .rate fields, but it could change the
> UAPI.
> 
> The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
> cancels the formatting operation in case of zero.
> 
> The bug was found by syzkaller.
> 
> Signed-off-by: Denis Efremov <efremov at ispras.ru>
> Tested-by: Willy Tarreau <w at 1wt.eu>
> Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
> 
> CVE-2019-14284
> 
> (cherry picked from commit f3554aeb991214cbfafd17d55e2bfddb50282e32)
> Signed-off-by: Sultan Alsawaf <sultan.alsawaf at canonical.com>
> ---
>  drivers/block/floppy.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 2daa5b84abbc..42ae1d2d8243 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -2113,6 +2113,9 @@ static void setup_format_params(int track)
>  	raw_cmd->kernel_data = floppy_track_buffer;
>  	raw_cmd->length = 4 * F_SECT_PER_TRACK;
>  
> +	if (!F_SECT_PER_TRACK)
> +		return;
> +
>  	/* allow for about 30ms for data transport per track */
>  	head_shift = (F_SECT_PER_TRACK + 5) / 6;
>  
> @@ -3235,6 +3238,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
>  	/* sanity checking for parameters. */
>  	if (g->sect <= 0 ||
>  	    g->head <= 0 ||
> +	    /* check for zero in F_SECT_PER_TRACK */
> +	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
>  	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
>  	    /* check if reserved bits are set */
>  	    (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
> -- 
> 2.20.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team