From patchwork Tue Apr 21 12:57:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Denis Efremov X-Patchwork-Id: 11501257 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 003C114B4 for ; Tue, 21 Apr 2020 12:58:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E37DF2076C for ; Tue, 21 Apr 2020 12:58:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728737AbgDUM6B (ORCPT ); Tue, 21 Apr 2020 08:58:01 -0400 Received: from mail-lj1-f193.google.com ([209.85.208.193]:39037 "EHLO mail-lj1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726628AbgDUM6A (ORCPT ); Tue, 21 Apr 2020 08:58:00 -0400 Received: by mail-lj1-f193.google.com with SMTP id u6so13877273ljl.6; Tue, 21 Apr 2020 05:57:58 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=EfnTedNe2IUpWuf+EJLADm5FOOxOv1WkovWVN+XtvOM=; b=AfnPk8bmCVXfbdt2Y41Zj1HmQQEebqhMn9XTIAZMPBsYEueK3ioFuSxVZiP68r7vKW 4nl1h6fvLbK1R1+W9izqzENkYzbmm5mNw/QaX3OsJPAilG30kOTLbkYfGGRuZJav3M0T sQL2qUwuQgubioHFGLu2ZLz06EfBB3ROItjAlFl0Mgo1wmO52v1f7qM9Q5lZVB63u1wZ dRSw9KknPPGyjOmhCNM1k1M3WnZ5jLBOGtM8SNr/yPdVn82u6ZIT/UELfy/fzo7Xe12/ y8XKFmpwIHNs5ummN4mbsB8L4ZVFvL+mwzdb7knlY9kb/k5hhe3BFAeW5reTh5zINyIq yYDQ== X-Gm-Message-State: AGi0PuaO9K7o+1X8fb7miTGx8KoQzrOSBWHHZtQF/M6kRkwqmONmQWfg Db5F5E0jXixZOH5VuoO4Jav73JfwD0A= X-Google-Smtp-Source: APiQypLeqH7AwrWoKi7mTMHXUx89vGDHJnaEr11yeF1ENryD4RV3FfN9wP7S7+gcwcYISExQMrNcLQ== X-Received: by 2002:a2e:b00a:: with SMTP id y10mr12371417ljk.158.1587473877635; Tue, 21 Apr 2020 05:57:57 -0700 (PDT) Received: from localhost.localdomain ([213.87.162.215]) by smtp.googlemail.com with ESMTPSA id z7sm1902268ljc.17.2020.04.21.05.57.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Apr 2020 05:57:57 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , linux-kernel@vger.kernel.org Subject: [PATCH 1/3] floppy: add FD_AUTODETECT_SIZE define for struct floppy_drive_params Date: Tue, 21 Apr 2020 15:57:20 +0300 Message-Id: <20200421125722.58959-2-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200421125722.58959-1-efremov@linux.com> References: <20200421125722.58959-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Use FD_AUTODETECT_SIZE for autodetect buffer size in struct floppy_drive_params instead of a magic number. Signed-off-by: Denis Efremov --- drivers/block/floppy.c | 9 +++++---- include/uapi/linux/fd.h | 5 ++++- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 2817170dd403..ac2023c757e3 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -2076,7 +2076,8 @@ static int next_valid_format(int drive) probed_format = drive_state[drive].probed_format; while (1) { - if (probed_format >= 8 || !drive_params[drive].autodetect[probed_format]) { + if (probed_format >= FD_AUTODETECT_SIZE || + !drive_params[drive].autodetect[probed_format]) { drive_state[drive].probed_format = 0; return 1; } @@ -3445,13 +3446,13 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo) return 0; } -static bool valid_floppy_drive_params(const short autodetect[8], +static bool valid_floppy_drive_params(const short autodetect[FD_AUTODETECT_SIZE], int native_format) { size_t floppy_type_size = ARRAY_SIZE(floppy_type); size_t i = 0; - for (i = 0; i < 8; ++i) { + for (i = 0; i < FD_AUTODETECT_SIZE; ++i) { if (autodetect[i] < 0 || autodetect[i] >= floppy_type_size) return false; @@ -3676,7 +3677,7 @@ struct compat_floppy_drive_params { struct floppy_max_errors max_errors; char flags; char read_track; - short autodetect[8]; + short autodetect[FD_AUTODETECT_SIZE]; compat_int_t checkfreq; compat_int_t native_format; }; diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 90fb94712c41..f5cb0aa8cebc 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -172,7 +172,10 @@ struct floppy_drive_params { * used in succession to try to read the disk. If the FDC cannot lock onto * the disk, the next format is tried. This uses the variable 'probing'. */ - short autodetect[8]; /* autodetected formats */ + +#define FD_AUTODETECT_SIZE 8 + + short autodetect[FD_AUTODETECT_SIZE]; /* autodetected formats */ int checkfreq; /* how often should the drive be checked for disk * changes */ From patchwork Tue Apr 21 12:57:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Denis Efremov X-Patchwork-Id: 11501259 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3CDDB913 for ; Tue, 21 Apr 2020 12:58:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2F0AA20781 for ; Tue, 21 Apr 2020 12:58:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728859AbgDUM6I (ORCPT ); Tue, 21 Apr 2020 08:58:08 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:44938 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726628AbgDUM6D (ORCPT ); Tue, 21 Apr 2020 08:58:03 -0400 Received: by mail-lj1-f196.google.com with SMTP id z26so13846269ljz.11; Tue, 21 Apr 2020 05:58:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0YlyCHUw312AmrzNw/IzEmeQ9OEPagxd5nkgVOWuL18=; b=oXL8gbvnut/7Feu4e7WVrga6hq+yJIpbapTIV468cy8dZo5CzBzzFngyxOyiRAgRCX eatJXii+IrkMGuSstC/k66JXY6yqsfk2CVnJ+95J4VKWXV9Zjv2rtVfyEt0gZoanT0bP N38/OW1L1LBXvqdo05iP6x9jcccEYPeFurEL1KmJT9WnSlwAy2xvVQ39Ifgan7Esk1+q 04Z9igiwF9AWIPCIxH8ksTDPrQRfC8pKD5A0+9FgSoxKjvGfPtb6SjDu/o2k4AQ68f4w YpaH8tDn7AWHB6iN131Nr+97neJFVmvmrApoFdhorr2XkIfJ4p4vbquyYLWEvBTiHAW+ Rp3Q== X-Gm-Message-State: AGi0PuYkwbLhtF+K95OYPx/H8Rq4R0XaFUjQ402qZ1/19s8iLTD/bQTp L3rji+XH7agfZyYkETyuBvh4ljMOJGU= X-Google-Smtp-Source: APiQypJTJzry8tRlksS0vJtcksH/Oki9gtXjnrTVHYsyPf2kz0qZgzLss6mvDTfpeIlG3bf/FNjDhQ== X-Received: by 2002:a05:651c:1203:: with SMTP id i3mr1308011lja.181.1587473880617; Tue, 21 Apr 2020 05:58:00 -0700 (PDT) Received: from localhost.localdomain ([213.87.162.215]) by smtp.googlemail.com with ESMTPSA id z7sm1902268ljc.17.2020.04.21.05.57.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Apr 2020 05:58:00 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , linux-kernel@vger.kernel.org Subject: [PATCH 2/3] floppy: add defines for sizes of cmd & reply buffers of floppy_raw_cmd Date: Tue, 21 Apr 2020 15:57:21 +0300 Message-Id: <20200421125722.58959-3-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200421125722.58959-1-efremov@linux.com> References: <20200421125722.58959-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Use FD_RAW_CMD_SIZE, FD_RAW_REPLY_SIZE defines instead of magic numbers for cmd & reply buffers of struct floppy_raw_cmd. Remove local to floppy.c MAX_REPLIES define, as it is now FD_RAW_REPLY_SIZE. Signed-off-by: Denis Efremov --- drivers/block/floppy.c | 15 ++++++++------- include/uapi/linux/fd.h | 8 ++++++-- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index ac2023c757e3..2169df796d18 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -337,8 +337,7 @@ static bool initialized; /* * globals used by 'result()' */ -#define MAX_REPLIES 16 -static unsigned char reply_buffer[MAX_REPLIES]; +static unsigned char reply_buffer[FD_RAW_REPLY_SIZE]; static int inr; /* size of reply buffer, when called from interrupt */ #define ST0 0 #define ST1 1 @@ -1165,7 +1164,7 @@ static int result(int fdc) int i; int status = 0; - for (i = 0; i < MAX_REPLIES; i++) { + for (i = 0; i < FD_RAW_REPLY_SIZE; i++) { status = wait_til_ready(fdc); if (status < 0) break; @@ -1847,7 +1846,7 @@ static void show_floppy(int fdc) output_log[(i + output_log_pos) % OLOGSIZE].jiffies); pr_info("last result at %lu\n", resultjiffies); pr_info("last redo_fd_request at %lu\n", lastredo); - print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1, + print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, FD_RAW_REPLY_SIZE, 1, reply_buffer, resultsize, true); pr_info("status=%x\n", fdc_inb(fdc, FD_STATUS)); @@ -3082,7 +3081,7 @@ static void raw_cmd_done(int flag) raw_cmd->flags |= FD_RAW_HARDFAILURE; } else { raw_cmd->reply_count = inr; - if (raw_cmd->reply_count > MAX_REPLIES) + if (raw_cmd->reply_count > FD_RAW_REPLY_SIZE) raw_cmd->reply_count = 0; for (i = 0; i < raw_cmd->reply_count; i++) raw_cmd->reply[i] = reply_buffer[i]; @@ -3193,7 +3192,9 @@ static int raw_cmd_copyin(int cmd, void __user *param, if (ret) return -EFAULT; param += sizeof(struct floppy_raw_cmd); - if (ptr->cmd_count > 33) + if (ptr->cmd_count > FD_RAW_CMD_SIZE + + sizeof_field(struct floppy_raw_cmd, reply_count) + + FD_RAW_REPLY_SIZE) /* the command may now also take up the space * initially intended for the reply & the * reply count. Needed for long 82078 commands @@ -3204,7 +3205,7 @@ static int raw_cmd_copyin(int cmd, void __user *param, */ return -EINVAL; - for (i = 0; i < 16; i++) + for (i = 0; i < FD_RAW_REPLY_SIZE; i++) ptr->reply[i] = 0; ptr->resultcode = 0; diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index f5cb0aa8cebc..d3961b52cb9a 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -360,10 +360,14 @@ struct floppy_raw_cmd { int buffer_length; /* length of allocated buffer */ unsigned char rate; + +#define FD_RAW_CMD_SIZE 16 +#define FD_RAW_REPLY_SIZE 16 + unsigned char cmd_count; - unsigned char cmd[16]; + unsigned char cmd[FD_RAW_CMD_SIZE]; unsigned char reply_count; - unsigned char reply[16]; + unsigned char reply[FD_RAW_REPLY_SIZE]; int track; int resultcode; From patchwork Tue Apr 21 12:57:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Denis Efremov X-Patchwork-Id: 11501261 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7759114B4 for ; Tue, 21 Apr 2020 12:58:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 67BEB20784 for ; Tue, 21 Apr 2020 12:58:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728879AbgDUM6L (ORCPT ); Tue, 21 Apr 2020 08:58:11 -0400 Received: from mail-lj1-f194.google.com ([209.85.208.194]:41722 "EHLO mail-lj1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728847AbgDUM6J (ORCPT ); Tue, 21 Apr 2020 08:58:09 -0400 Received: by mail-lj1-f194.google.com with SMTP id j3so13815857ljg.8; Tue, 21 Apr 2020 05:58:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=CzVUK+8+Cyh1jLtMoHSeKW2urHEoxIGPwaTFRn76lTw=; b=j0OsekL5Osxppy2wDCC/PZmFUtKjWAGQJSgQNwmgKav/0QzwugYc8biG+e6IMqQUL1 fH02eqvLuYJBGNu/o538eXrPe0fXNRof40ARKNjWEqZ8/2jLVo1VT2413xOUmnNt5+rS sNnQGySkJXpvDzLrNbVY1biW7dJbUPwp/zNzhgV4JrU8l3CFH57LeFGGSbOaIohTefob gHuaT7EeGDpbdfbjc6dDJt06ocuiCg0/ljNbrdCvEMnvk/MWewvZyB2flshXsdGlLT4f V5TnehzGUbrKM1ezoNuXnwr3Irud0kowYr0EUstyQOx/RZ3F1971xBZ+n+rFdMqRl9+R C+VA== X-Gm-Message-State: AGi0PuaOZHqkwBjwY+pvDaafH+TR/QOVLf6AinkfRdg5JApHmnj0ubqs Oh5MA94eKU5qkC6DplgIZVPt4Nwsrfk= X-Google-Smtp-Source: APiQypKxJtA3MtIiQ2i/vmvcCwJwiT+OXbiq75A5z+5zXbOcOXKA/TW+DDAHJwHMa7mfBXyPaRYD1w== X-Received: by 2002:a2e:164b:: with SMTP id 11mr12901489ljw.23.1587473887028; Tue, 21 Apr 2020 05:58:07 -0700 (PDT) Received: from localhost.localdomain ([213.87.162.215]) by smtp.googlemail.com with ESMTPSA id z7sm1902268ljc.17.2020.04.21.05.58.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Apr 2020 05:58:03 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , linux-kernel@vger.kernel.org Subject: [PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy() Date: Tue, 21 Apr 2020 15:57:22 +0300 Message-Id: <20200421125722.58959-4-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200421125722.58959-1-efremov@linux.com> References: <20200421125722.58959-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45 index 16 is out of range for type 'unsigned char [16]' Call Trace: ... setup_rw_floppy+0x5c3/0x7f0 floppy_ready+0x2be/0x13b0 process_one_work+0x2c1/0x5d0 worker_thread+0x56/0x5e0 kthread+0x122/0x170 ret_from_fork+0x35/0x40 From include/uapi/linux/fd.h: struct floppy_raw_cmd { ... unsigned char cmd_count; unsigned char cmd[16]; unsigned char reply_count; unsigned char reply[16]; ... } This out-of-bounds access is intentional. The command in struct floppy_raw_cmd may take up the space initially intended for the reply and the reply count. It is needed for long 82078 commands such as RESTORE, which takes 17 command bytes. Initial cmd size is not enough and since struct setup_rw_floppy is a part of uapi we check that cmd_count is in [0:16+1+16] in raw_cmd_copyin(). The patch replaces array subscript with pointer arithetic to suppress UBSAN warning. Signed-off-by: Denis Efremov --- drivers/block/floppy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 2169df796d18..63981b1f8d4c 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -1518,7 +1518,10 @@ static void setup_rw_floppy(void) r = 0; for (i = 0; i < raw_cmd->cmd_count; i++) - r |= output_byte(current_fdc, raw_cmd->cmd[i]); + /* The command may take up the space initially intended for the + * reply and the reply count. + */ + r |= output_byte(current_fdc, *(raw_cmd->cmd + i)); debugt(__func__, "rw_command");