lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 359/575] ataflop: potential out of bounds in do_format()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 1ffec389a6431782a8a28805830b6fae9bf00af1 ]

    The function uses "type" as an array index:

    q = unit[drive].disk[type]->queue;

    Unfortunately the bounds check on "type" isn't done until later in the
    function. Fix this by moving the bounds check to the start.

    Fixes: bf9c0538e485 ("ataflop: use a separate gendisk for each media format")
    Reported-by: kernel test robot <lkp@intel.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/block/ataflop.c | 11 +++++------
    1 file changed, 5 insertions(+), 6 deletions(-)

    diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
    index e6264db11e415..0a86f9d3a3798 100644
    --- a/drivers/block/ataflop.c
    +++ b/drivers/block/ataflop.c
    @@ -726,8 +726,12 @@ static int do_format(int drive, int type, struct atari_format_descr *desc)
    unsigned long flags;
    int ret;

    - if (type)
    + if (type) {
    type--;
    + if (type >= NUM_DISK_MINORS ||
    + minor2disktype[type].drive_types > DriveType)
    + return -EINVAL;
    + }

    q = unit[drive].disk[type]->queue;
    blk_mq_freeze_queue(q);
    @@ -739,11 +743,6 @@ static int do_format(int drive, int type, struct atari_format_descr *desc)
    local_irq_restore(flags);

    if (type) {
    - if (type >= NUM_DISK_MINORS ||
    - minor2disktype[type].drive_types > DriveType) {
    - ret = -EINVAL;
    - goto out;
    - }
    type = minor2disktype[type].index;
    UDT = &atari_disk_type[type];
    }
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-15 21:40    [W:2.386 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site