diff options
| author | Denis Efremov <efremov@ispras.ru> | 2019-07-12 21:55:22 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-26 10:14:18 +0300 |
| commit | a9444d9d0f6f47a7894a5762d25f9ed0965188c6 (patch) | |
| tree | ae4dcd9bf0130604604e495f8190f66d4ff77056 /drivers/xen | |
| parent | 5b565f3276f3bafdf912e94ede83430aa604ed08 (diff) | |
| download | linux-a9444d9d0f6f47a7894a5762d25f9ed0965188c6.tar.xz | |
floppy: fix invalid pointer dereference in drive_name
[ Upstream commit 9b04609b784027968348796a18f601aed9db3789 ]
This fixes the invalid pointer dereference in the drive_name function of
the floppy driver.
The native_format field of the struct floppy_drive_params is used as
floppy_type array index in the drive_name function. Thus, the field
should be checked the same way as the autodetect field.
To trigger the bug, one could use a value out of range and set the drive
parameters with the FDSETDRVPRM ioctl. Next, FDGETDRVTYP ioctl should
be used to call the drive_name. A floppy disk is not required to be
inserted.
CAP_SYS_ADMIN is required to call FDSETDRVPRM.
The patch adds the check for a value of the native_format field to be in
the '0 <= x < ARRAY_SIZE(floppy_type)' range of the floppy_type array
indices.
The bug was found by syzkaller.
Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/xen')
0 files changed, 0 insertions, 0 deletions