From patchwork Sun Apr 26 13:07:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11510625 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CB3F2913 for ; Sun, 26 Apr 2020 13:08:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BBB4A20700 for ; Sun, 26 Apr 2020 13:08:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726166AbgDZNIT (ORCPT ); Sun, 26 Apr 2020 09:08:19 -0400 Received: from mail-lf1-f66.google.com ([209.85.167.66]:39313 "EHLO mail-lf1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725876AbgDZNIS (ORCPT ); Sun, 26 Apr 2020 09:08:18 -0400 Received: by mail-lf1-f66.google.com with SMTP id m2so11493196lfo.6; Sun, 26 Apr 2020 06:08:16 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=HT2BCSWgzxUdrlLCBm0qqAESIN+EGNUthAVxzQxAcj8=; b=Js4PY6eA7BqbPLWqtiWL5cninSkIY/HZhSwEJNH3rYGAZaAboOgalP9GAhjA+6epNI vYbRPQD4Yt5K8IKYMzQ2t7GI3ua8NFKDkvyf2TOzOdu68FjsOqTUyZ7C4cNpanBZPkcD Alzjg7sSDACC8gSxSXhm2cJ7FXZFS8E0hJIZ17IOWSmqEohXxKNfconwMJ0daiOgWrTB xmiqRgovOT++cI1n/QjxmLATy+S4n5MHG3eOJQwlKfZ1LNc6PEclkQCSaT9jJjou+/kX FZd7uizqe9iWI/c5MDhNTXNe564ihV6Cj69a0VNjKaI57+9H+nNMl8TiIwdfJfZKKF9E fhUg== X-Gm-Message-State: AGi0PubHftkHMv/LuY2+KsYdtuXeOzHq6Xz+/XuPe/dVc9NqJ2ib8JxN 5vQtzxUg+sp1N6ZgGl9y5bEeZuinSFg= X-Google-Smtp-Source: APiQypJMEtsE5XE2fYqdbfbyQGVTVlbrLJ0IODli+VwrLEl1i6FzIdmpAY3ict9US+kr3I5KwMb8kA== X-Received: by 2002:ac2:551e:: with SMTP id j30mr12701110lfk.179.1587906495848; Sun, 26 Apr 2020 06:08:15 -0700 (PDT) Received: from localhost.localdomain ([213.87.147.211]) by smtp.googlemail.com with ESMTPSA id l8sm7983371ljo.5.2020.04.26.06.08.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Apr 2020 06:08:15 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] floppy: add FD_AUTODETECT_SIZE define for struct floppy_drive_params Date: Sun, 26 Apr 2020 16:07:26 +0300 Message-Id: <20200426130728.63399-2-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200426130728.63399-1-efremov@linux.com> References: <20200426130728.63399-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Use FD_AUTODETECT_SIZE for autodetect buffer size in struct floppy_drive_params instead of a magic number. Signed-off-by: Denis Efremov --- drivers/block/floppy.c | 9 +++++---- include/uapi/linux/fd.h | 5 ++++- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 2817170dd403..ac2023c757e3 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -2076,7 +2076,8 @@ static int next_valid_format(int drive) probed_format = drive_state[drive].probed_format; while (1) { - if (probed_format >= 8 || !drive_params[drive].autodetect[probed_format]) { + if (probed_format >= FD_AUTODETECT_SIZE || + !drive_params[drive].autodetect[probed_format]) { drive_state[drive].probed_format = 0; return 1; } @@ -3445,13 +3446,13 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo) return 0; } -static bool valid_floppy_drive_params(const short autodetect[8], +static bool valid_floppy_drive_params(const short autodetect[FD_AUTODETECT_SIZE], int native_format) { size_t floppy_type_size = ARRAY_SIZE(floppy_type); size_t i = 0; - for (i = 0; i < 8; ++i) { + for (i = 0; i < FD_AUTODETECT_SIZE; ++i) { if (autodetect[i] < 0 || autodetect[i] >= floppy_type_size) return false; @@ -3676,7 +3677,7 @@ struct compat_floppy_drive_params { struct floppy_max_errors max_errors; char flags; char read_track; - short autodetect[8]; + short autodetect[FD_AUTODETECT_SIZE]; compat_int_t checkfreq; compat_int_t native_format; }; diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 90fb94712c41..3f6b7be4c096 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -172,7 +172,10 @@ struct floppy_drive_params { * used in succession to try to read the disk. If the FDC cannot lock onto * the disk, the next format is tried. This uses the variable 'probing'. */ - short autodetect[8]; /* autodetected formats */ + +#define FD_AUTODETECT_SIZE 8 + + short autodetect[FD_AUTODETECT_SIZE]; /* autodetected formats */ int checkfreq; /* how often should the drive be checked for disk * changes */ From patchwork Sun Apr 26 13:07:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11510627 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 73DF1912 for ; Sun, 26 Apr 2020 13:08:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6650220700 for ; Sun, 26 Apr 2020 13:08:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726204AbgDZNIX (ORCPT ); Sun, 26 Apr 2020 09:08:23 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:38541 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725876AbgDZNIX (ORCPT ); Sun, 26 Apr 2020 09:08:23 -0400 Received: by mail-lf1-f68.google.com with SMTP id l11so11507701lfc.5; Sun, 26 Apr 2020 06:08:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=CF3KyLIy2CcCqiBV6fft8p9lx2gIpZejdD8aG2l37ro=; b=AvTjr4M2bFz21JDBLfwRon3nrdYr+TZTLUtPjrSPV9IU0shbGGIDtPUbjIj9UGgNcz PFzFNR96Jq+bc455k2QA4xDlG2c0S9HgWiiNGeD6nSFbba1+iccnAS09iUZQzEi3U9cG I3ykygZPHiDyomEkEorw9CnZezVxR+MUBrjchv0nPRZXxPZ51/LLHqx8ujng/qICyU1M SbuzWVgrSv1gEjljzBB5R4h4TyyBDPnu2r+eflqPOdDvYCShKYtl3E5wb3uHC1H6AAiK 7a2ezmvl7kI4x1L6ppPbD1VDQck9aBieNFdp1fmLudMeWVXDPTKPwxaC+v3x6fg1p+9w Z4Cg== X-Gm-Message-State: AGi0PuZlvlhhJ97r0CTHZSYF1FVi43d767HkdrZbVZL7qmYMkAkM1lBL B+0Bpb/nFKfu1DDyJ2/cMJyljXWw8/8= X-Google-Smtp-Source: APiQypKWNjm/xKK3C2eldFQ4dq8rpfu1ZFh2p59OPa3olR+/b1zPyeYu/FJW5k0jYCan/Fq1qbCOiw== X-Received: by 2002:ac2:420c:: with SMTP id y12mr12410585lfh.26.1587906498806; Sun, 26 Apr 2020 06:08:18 -0700 (PDT) Received: from localhost.localdomain ([213.87.147.211]) by smtp.googlemail.com with ESMTPSA id l8sm7983371ljo.5.2020.04.26.06.08.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Apr 2020 06:08:18 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] floppy: add defines for sizes of cmd & reply buffers of floppy_raw_cmd Date: Sun, 26 Apr 2020 16:07:27 +0300 Message-Id: <20200426130728.63399-3-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200426130728.63399-1-efremov@linux.com> References: <20200426130728.63399-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Use FD_RAW_CMD_SIZE, FD_RAW_REPLY_SIZE defines instead of magic numbers for cmd & reply buffers of struct floppy_raw_cmd. Remove local to floppy.c MAX_REPLIES define, as it is now FD_RAW_REPLY_SIZE. FD_RAW_CMD_FULLSIZE added as we allow command to also fill reply_count and reply fields. Signed-off-by: Denis Efremov Reviewed-by: Christoph Hellwig --- drivers/block/floppy.c | 21 ++++++--------------- include/uapi/linux/fd.h | 14 ++++++++++++-- 2 files changed, 18 insertions(+), 17 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index ac2023c757e3..052ba457956e 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -337,8 +337,7 @@ static bool initialized; /* * globals used by 'result()' */ -#define MAX_REPLIES 16 -static unsigned char reply_buffer[MAX_REPLIES]; +static unsigned char reply_buffer[FD_RAW_REPLY_SIZE]; static int inr; /* size of reply buffer, when called from interrupt */ #define ST0 0 #define ST1 1 @@ -1165,7 +1164,7 @@ static int result(int fdc) int i; int status = 0; - for (i = 0; i < MAX_REPLIES; i++) { + for (i = 0; i < FD_RAW_REPLY_SIZE; i++) { status = wait_til_ready(fdc); if (status < 0) break; @@ -1847,7 +1846,7 @@ static void show_floppy(int fdc) output_log[(i + output_log_pos) % OLOGSIZE].jiffies); pr_info("last result at %lu\n", resultjiffies); pr_info("last redo_fd_request at %lu\n", lastredo); - print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1, + print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, FD_RAW_REPLY_SIZE, 1, reply_buffer, resultsize, true); pr_info("status=%x\n", fdc_inb(fdc, FD_STATUS)); @@ -3082,7 +3081,7 @@ static void raw_cmd_done(int flag) raw_cmd->flags |= FD_RAW_HARDFAILURE; } else { raw_cmd->reply_count = inr; - if (raw_cmd->reply_count > MAX_REPLIES) + if (raw_cmd->reply_count > FD_RAW_REPLY_SIZE) raw_cmd->reply_count = 0; for (i = 0; i < raw_cmd->reply_count; i++) raw_cmd->reply[i] = reply_buffer[i]; @@ -3193,18 +3192,10 @@ static int raw_cmd_copyin(int cmd, void __user *param, if (ret) return -EFAULT; param += sizeof(struct floppy_raw_cmd); - if (ptr->cmd_count > 33) - /* the command may now also take up the space - * initially intended for the reply & the - * reply count. Needed for long 82078 commands - * such as RESTORE, which takes ... 17 command - * bytes. Murphy's law #137: When you reserve - * 16 bytes for a structure, you'll one day - * discover that you really need 17... - */ + if (ptr->cmd_count > FD_RAW_CMD_FULLSIZE) return -EINVAL; - for (i = 0; i < 16; i++) + for (i = 0; i < FD_RAW_REPLY_SIZE; i++) ptr->reply[i] = 0; ptr->resultcode = 0; diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 3f6b7be4c096..2e9c2c1c18e6 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -360,10 +360,20 @@ struct floppy_raw_cmd { int buffer_length; /* length of allocated buffer */ unsigned char rate; + +#define FD_RAW_CMD_SIZE 16 +#define FD_RAW_REPLY_SIZE 16 +#define FD_RAW_CMD_FULLSIZE (FD_RAW_CMD_SIZE + 1 + FD_RAW_REPLY_SIZE) + + /* The command may take up the space initially intended for the reply + * and the reply count. Needed for long 82078 commands such as RESTORE, + * which takes 17 command bytes. + */ + unsigned char cmd_count; - unsigned char cmd[16]; + unsigned char cmd[FD_RAW_CMD_SIZE]; unsigned char reply_count; - unsigned char reply[16]; + unsigned char reply[FD_RAW_REPLY_SIZE]; int track; int resultcode; From patchwork Sun Apr 26 13:07:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11510629 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9CB49913 for ; Sun, 26 Apr 2020 13:08:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8EBF7216FD for ; Sun, 26 Apr 2020 13:08:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1725876AbgDZNIZ (ORCPT ); Sun, 26 Apr 2020 09:08:25 -0400 Received: from mail-lj1-f193.google.com ([209.85.208.193]:35295 "EHLO mail-lj1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726139AbgDZNIY (ORCPT ); Sun, 26 Apr 2020 09:08:24 -0400 Received: by mail-lj1-f193.google.com with SMTP id g4so14690234ljl.2; Sun, 26 Apr 2020 06:08:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=KqhP1IZD0rJb6u6gP/e9HC5zJzCBcsPMyaLVpJZsqD4=; b=XjFqbMhTFw6I3hYRZYw6FS7AY8aYnqyv3bJ5EOqGvhlRJGDZqBpKdMmyyezBQ2ymXQ 79ZlD43v7d0gZMcN2amZe89AFkFnYdAlFnMfiI2dvLdu/uJGr/CXyrXSS2OL/xzVWPBw Su3IDGEOqEL0ro4J2s4zvYjcGvgfYlWeNSO0VY8e51KsQvq/MYXknWn65SWIB/NEOf88 YomfbrcO5JdFNf+tmtcXPSzydoEvkJeM2maVEAqZoADy2YSP7AMupbV1E4livSWUs0tZ OR2enSHgeqfX2pw1T6psACDbUL1qq/1GlNpQ1ge8Iutjb9Kbp9EA4D+4g4ffO7m0u0qb qEXA== X-Gm-Message-State: AGi0PuZnLzwpY7UlfoYpZouSwetUYKX3fEgwrUMQC233oflPz3RGpLez 1o8UIax5DzM5Vx+D1fPHjylBXBVkOHs= X-Google-Smtp-Source: APiQypIvtjCdhzqmTqyRppstszegxNCVRgcToRc/Vivyyg1DLqbMx6EsxnfNe6CW7L0aif2WbYAQag== X-Received: by 2002:a2e:2a82:: with SMTP id q124mr11975552ljq.155.1587906501607; Sun, 26 Apr 2020 06:08:21 -0700 (PDT) Received: from localhost.localdomain ([213.87.147.211]) by smtp.googlemail.com with ESMTPSA id l8sm7983371ljo.5.2020.04.26.06.08.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Apr 2020 06:08:21 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , linux-kernel@vger.kernel.org Subject: [PATCH v2 3/3] floppy: suppress UBSAN warning in setup_rw_floppy() Date: Sun, 26 Apr 2020 16:07:28 +0300 Message-Id: <20200426130728.63399-4-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200426130728.63399-1-efremov@linux.com> References: <20200426130728.63399-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45 index 16 is out of range for type 'unsigned char [16]' Call Trace: ... setup_rw_floppy+0x5c3/0x7f0 floppy_ready+0x2be/0x13b0 process_one_work+0x2c1/0x5d0 worker_thread+0x56/0x5e0 kthread+0x122/0x170 ret_from_fork+0x35/0x40 From include/uapi/linux/fd.h: struct floppy_raw_cmd { ... unsigned char cmd_count; unsigned char cmd[16]; unsigned char reply_count; unsigned char reply[16]; ... } This out-of-bounds access is intentional. The command in struct floppy_raw_cmd may take up the space initially intended for the reply and the reply count. It is needed for long 82078 commands such as RESTORE, which takes 17 command bytes. Initial cmd size is not enough and since struct setup_rw_floppy is a part of uapi we check that cmd_count is in [0:16+1+16] in raw_cmd_copyin(). The patch adds union with original cmd,reply_count,reply fields and fullcmd field of equivalent size. The cmd accesses are turned to fullcmd where appropriate to suppress UBSAN warning. Signed-off-by: Denis Efremov Reviewed-by: Christoph Hellwig --- drivers/block/floppy.c | 4 ++-- include/uapi/linux/fd.h | 11 ++++++++--- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 052ba457956e..1b22aab6cd9b 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -1072,7 +1072,7 @@ static void setup_DMA(void) pr_info("zero dma transfer size:"); for (i = 0; i < raw_cmd->cmd_count; i++) - pr_cont("%x,", raw_cmd->cmd[i]); + pr_cont("%x,", raw_cmd->fullcmd[i]); pr_cont("\n"); cont->done(0); fdc_state[current_fdc].reset = 1; @@ -1518,7 +1518,7 @@ static void setup_rw_floppy(void) r = 0; for (i = 0; i < raw_cmd->cmd_count; i++) - r |= output_byte(current_fdc, raw_cmd->cmd[i]); + r |= output_byte(current_fdc, raw_cmd->fullcmd[i]); debugt(__func__, "rw_command"); diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 2e9c2c1c18e6..8b80c63b971c 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -371,9 +371,14 @@ struct floppy_raw_cmd { */ unsigned char cmd_count; - unsigned char cmd[FD_RAW_CMD_SIZE]; - unsigned char reply_count; - unsigned char reply[FD_RAW_REPLY_SIZE]; + union { + struct { + unsigned char cmd[FD_RAW_CMD_SIZE]; + unsigned char reply_count; + unsigned char reply[FD_RAW_REPLY_SIZE]; + }; + unsigned char fullcmd[FD_RAW_CMD_FULLSIZE]; + }; int track; int resultcode;