From patchwork Fri May 1 13:44:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11522575 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 61EEE913 for ; Fri, 1 May 2020 13:46:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5302920836 for ; Fri, 1 May 2020 13:46:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730457AbgEANqP (ORCPT ); Fri, 1 May 2020 09:46:15 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:41127 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731801AbgEANo5 (ORCPT ); Fri, 1 May 2020 09:44:57 -0400 Received: by mail-lj1-f196.google.com with SMTP id j3so2625727ljg.8; Fri, 01 May 2020 06:44:56 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=HfgY/DHsULUZEl+7rWuesO+JiGINR2RoKVUEnFZIbxY=; b=pxXj1FjY94uKiY9NjZ20d37GK+1O1u7oXO9tUyCiEc0ovwW2BufjqFedJyGDc0Ilik H7IOODCIGaTPLp2BBkTp80LTjeaCasB377ri6AIYpbUO50nR4GcRHGoGwlUPDPwUjl3y krcxBl0CXex5g1po9+OSMxCTRd9JkH6v0BjYgoigBJDTmBNLykM3pwmCyrjP9ur1D4CF viuOc3AVKU9OHTmVj+RZBiqPSG3fHiEoN3zqOKnAXcoqE8ZOTPtlWPSyPfj2EoCbL/Rs ONL0sWoUiJ68coTmv4LK7EDIHfILo114XLGOtpj7e+y5snA3QOU5+qQ5oca1VmAOY7eU AdDw== X-Gm-Message-State: AGi0PuZcqvRHFNkoUrzYa9Oefr4qpGWV71qxcGO225lRHBeoqHZrOB4U MVaPTjKBOtXSCp0qW2096+Jou24KDoY= X-Google-Smtp-Source: APiQypLLnLvr4dk8xp7GQLrt6zVvZS8jE+F2qmlVymQDLmCndkfNoRtlWTL3RdGAcX7Y5jA6B94WvQ== X-Received: by 2002:a2e:a417:: with SMTP id p23mr2628367ljn.19.1588340695103; Fri, 01 May 2020 06:44:55 -0700 (PDT) Received: from localhost.localdomain ([213.87.150.177]) by smtp.googlemail.com with ESMTPSA id b2sm2269194lfi.14.2020.05.01.06.44.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2020 06:44:54 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , Joe Perches , linux-kernel@vger.kernel.org Subject: [PATCH v3 1/4] floppy: use print_hex_dump() in setup_DMA() Date: Fri, 1 May 2020 16:44:13 +0300 Message-Id: <20200501134416.72248-2-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200501134416.72248-1-efremov@linux.com> References: <20200501134416.72248-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Remove pr_cont() and use print_hex_dump() in setup_DMA() to print the contents of the cmd buffer. Suggested-by: Joe Perches Signed-off-by: Denis Efremov Reviewed-by: Christoph Hellwig --- drivers/block/floppy.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 2817170dd403..3ab6e804b5ec 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -1069,12 +1069,9 @@ static void setup_DMA(void) unsigned long f; if (raw_cmd->length == 0) { - int i; - - pr_info("zero dma transfer size:"); - for (i = 0; i < raw_cmd->cmd_count; i++) - pr_cont("%x,", raw_cmd->cmd[i]); - pr_cont("\n"); + print_hex_dump(KERN_INFO, "zero dma transfer size: ", + DUMP_PREFIX_NONE, 16, 1, + raw_cmd->cmd, raw_cmd->cmd_count, false); cont->done(0); fdc_state[current_fdc].reset = 1; return; From patchwork Fri May 1 13:44:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11522579 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4167014B4 for ; Fri, 1 May 2020 13:47:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 307AD20757 for ; Fri, 1 May 2020 13:47:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731086AbgEANrK (ORCPT ); Fri, 1 May 2020 09:47:10 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:38526 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730317AbgEANpK (ORCPT ); Fri, 1 May 2020 09:45:10 -0400 Received: by mail-lf1-f68.google.com with SMTP id l11so3898488lfc.5; Fri, 01 May 2020 06:45:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=UjJIbG5PhVX5vmhqPNitT7lQ30lLq2zeuGUdDd0kBno=; b=ii/dZOXMNrZNV8QMGycWL5eYUUGhoDWQyGJfFF+Md4PHlDjqs9IoKTxeBSoxv1OB3D M/rWnP2+RWC/UswRA8h6ETXtWD77Ez3yy3j4GaslGVAaFof3LTG11tSvnIpJdoyjGdeS JoX0rFuw/F8/WOSXqAjolvu7g2cYU5hyW2V2j2N76LQqv+6DwDqnUsTJLqoDP+e3q8Iw FHMMwr/AhAZLQCjj8ZtRs9NfC+Vw5laAUxUngoTUFfO5VrtzGTO9joaryPpJx6Coxqa7 CmyqiywphXgIoqK/CZM9ljSaYGXvjRqQLFpmO8Jc2F7DQX6cntrkjZjkeza48Fy7Uhju 2mMg== X-Gm-Message-State: AGi0PubXipHgTwZZ/C/nmzYIRCK3vPp9qHKgsJVbz3YR3Tom2n4qurVG iyJecKwZ9vTgM4u/vgTrVDtc1W+LdaU= X-Google-Smtp-Source: APiQypLpRwyPk/YLnGS6RZt+lZLtIcEoigTyTI4Fv+U69ZYu+k+Kk5S8LgwaIbSQAROqdGz0bj8YNQ== X-Received: by 2002:a19:42c3:: with SMTP id p186mr2590791lfa.194.1588340707226; Fri, 01 May 2020 06:45:07 -0700 (PDT) Received: from localhost.localdomain ([213.87.150.177]) by smtp.googlemail.com with ESMTPSA id b2sm2269194lfi.14.2020.05.01.06.45.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2020 06:45:06 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , Joe Perches , linux-kernel@vger.kernel.org Subject: [PATCH v3 2/4] floppy: add FD_AUTODETECT_SIZE define for struct floppy_drive_params Date: Fri, 1 May 2020 16:44:14 +0300 Message-Id: <20200501134416.72248-3-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200501134416.72248-1-efremov@linux.com> References: <20200501134416.72248-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Use FD_AUTODETECT_SIZE for autodetect buffer size in struct floppy_drive_params instead of a magic number. Signed-off-by: Denis Efremov Reviewed-by: Christoph Hellwig --- drivers/block/floppy.c | 9 +++++---- include/uapi/linux/fd.h | 5 ++++- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 3ab6e804b5ec..b82b3d38b834 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -2073,7 +2073,8 @@ static int next_valid_format(int drive) probed_format = drive_state[drive].probed_format; while (1) { - if (probed_format >= 8 || !drive_params[drive].autodetect[probed_format]) { + if (probed_format >= FD_AUTODETECT_SIZE || + !drive_params[drive].autodetect[probed_format]) { drive_state[drive].probed_format = 0; return 1; } @@ -3442,13 +3443,13 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo) return 0; } -static bool valid_floppy_drive_params(const short autodetect[8], +static bool valid_floppy_drive_params(const short autodetect[FD_AUTODETECT_SIZE], int native_format) { size_t floppy_type_size = ARRAY_SIZE(floppy_type); size_t i = 0; - for (i = 0; i < 8; ++i) { + for (i = 0; i < FD_AUTODETECT_SIZE; ++i) { if (autodetect[i] < 0 || autodetect[i] >= floppy_type_size) return false; @@ -3673,7 +3674,7 @@ struct compat_floppy_drive_params { struct floppy_max_errors max_errors; char flags; char read_track; - short autodetect[8]; + short autodetect[FD_AUTODETECT_SIZE]; compat_int_t checkfreq; compat_int_t native_format; }; diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 90fb94712c41..3f6b7be4c096 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -172,7 +172,10 @@ struct floppy_drive_params { * used in succession to try to read the disk. If the FDC cannot lock onto * the disk, the next format is tried. This uses the variable 'probing'. */ - short autodetect[8]; /* autodetected formats */ + +#define FD_AUTODETECT_SIZE 8 + + short autodetect[FD_AUTODETECT_SIZE]; /* autodetected formats */ int checkfreq; /* how often should the drive be checked for disk * changes */ From patchwork Fri May 1 13:44:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11522567 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C0D37913 for ; Fri, 1 May 2020 13:45:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B0B5D20836 for ; Fri, 1 May 2020 13:45:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731399AbgEANpP (ORCPT ); Fri, 1 May 2020 09:45:15 -0400 Received: from mail-lf1-f67.google.com ([209.85.167.67]:38531 "EHLO mail-lf1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731541AbgEANpO (ORCPT ); Fri, 1 May 2020 09:45:14 -0400 Received: by mail-lf1-f67.google.com with SMTP id l11so3898611lfc.5; Fri, 01 May 2020 06:45:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=84T0pCv1NUHY99+EIUt2kRwIXnXQcTzPiOYLMrXMKNI=; b=uRd8skZcAgeL8fLulHY2Adc0M59m9MWJHiNj2jep4dlkDnmGVcXpA0r8BmEaYxt4EU DQyjapijaMBQZsh/bqKS+LmvEnZ8l5x+hkX2yjcYKeC/uRsWKSZRe6fPrGxzs+IOmcIl N0JIfdHus1VW+yxssKZn0UKHiJzG//fFNUJv+C9/ZK+3CA9yyzDHNxELX292WJd4KVG8 LEePvZiC/xEzLMLY+K/pzZ5Mw3rwDeUP+PAAdWa7YiDff3va6Rd+T1wGLTe+laTzTeAe nvjEX10x7PxDpeSaR2TKOz9uuZ3SqBhWHhMCAdVsU4qgLh6/KET1YW7xk9Jvd+2Y0E6/ N5EQ== X-Gm-Message-State: AGi0PuZf+kcICSRUxTt7aJGpLMQTlRRm9owzZryy9MHfZABcVVz/houI EO3VLoZFCCLx0+BZfACndTFGPoKwFH4= X-Google-Smtp-Source: APiQypI1EFhtVvq/oZA1yWy/XUHw1zB0+GFXJDQXQL3SsKS2vEbAEA1aHhauzMg8ygiv9o6vfRTvTA== X-Received: by 2002:ac2:46f9:: with SMTP id q25mr2637273lfo.149.1588340710968; Fri, 01 May 2020 06:45:10 -0700 (PDT) Received: from localhost.localdomain ([213.87.150.177]) by smtp.googlemail.com with ESMTPSA id b2sm2269194lfi.14.2020.05.01.06.45.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2020 06:45:10 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , Joe Perches , linux-kernel@vger.kernel.org, Christoph Hellwig Subject: [PATCH v3 3/4] floppy: add defines for sizes of cmd & reply buffers of floppy_raw_cmd Date: Fri, 1 May 2020 16:44:15 +0300 Message-Id: <20200501134416.72248-4-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200501134416.72248-1-efremov@linux.com> References: <20200501134416.72248-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org Use FD_RAW_CMD_SIZE, FD_RAW_REPLY_SIZE defines instead of magic numbers for cmd & reply buffers of struct floppy_raw_cmd. Remove local to floppy.c MAX_REPLIES define, as it is now FD_RAW_REPLY_SIZE. FD_RAW_CMD_FULLSIZE added as we allow command to also fill reply_count and reply fields. Reviewed-by: Christoph Hellwig Signed-off-by: Denis Efremov --- drivers/block/floppy.c | 19 +++++-------------- include/uapi/linux/fd.h | 14 ++++++++++++-- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index b82b3d38b834..9e098d53b046 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -337,8 +337,7 @@ static bool initialized; /* * globals used by 'result()' */ -#define MAX_REPLIES 16 -static unsigned char reply_buffer[MAX_REPLIES]; +static unsigned char reply_buffer[FD_RAW_REPLY_SIZE]; static int inr; /* size of reply buffer, when called from interrupt */ #define ST0 0 #define ST1 1 @@ -1162,7 +1161,7 @@ static int result(int fdc) int i; int status = 0; - for (i = 0; i < MAX_REPLIES; i++) { + for (i = 0; i < FD_RAW_REPLY_SIZE; i++) { status = wait_til_ready(fdc); if (status < 0) break; @@ -3079,7 +3078,7 @@ static void raw_cmd_done(int flag) raw_cmd->flags |= FD_RAW_HARDFAILURE; } else { raw_cmd->reply_count = inr; - if (raw_cmd->reply_count > MAX_REPLIES) + if (raw_cmd->reply_count > FD_RAW_REPLY_SIZE) raw_cmd->reply_count = 0; for (i = 0; i < raw_cmd->reply_count; i++) raw_cmd->reply[i] = reply_buffer[i]; @@ -3190,18 +3189,10 @@ static int raw_cmd_copyin(int cmd, void __user *param, if (ret) return -EFAULT; param += sizeof(struct floppy_raw_cmd); - if (ptr->cmd_count > 33) - /* the command may now also take up the space - * initially intended for the reply & the - * reply count. Needed for long 82078 commands - * such as RESTORE, which takes ... 17 command - * bytes. Murphy's law #137: When you reserve - * 16 bytes for a structure, you'll one day - * discover that you really need 17... - */ + if (ptr->cmd_count > FD_RAW_CMD_FULLSIZE) return -EINVAL; - for (i = 0; i < 16; i++) + for (i = 0; i < FD_RAW_REPLY_SIZE; i++) ptr->reply[i] = 0; ptr->resultcode = 0; diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 3f6b7be4c096..2e9c2c1c18e6 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -360,10 +360,20 @@ struct floppy_raw_cmd { int buffer_length; /* length of allocated buffer */ unsigned char rate; + +#define FD_RAW_CMD_SIZE 16 +#define FD_RAW_REPLY_SIZE 16 +#define FD_RAW_CMD_FULLSIZE (FD_RAW_CMD_SIZE + 1 + FD_RAW_REPLY_SIZE) + + /* The command may take up the space initially intended for the reply + * and the reply count. Needed for long 82078 commands such as RESTORE, + * which takes 17 command bytes. + */ + unsigned char cmd_count; - unsigned char cmd[16]; + unsigned char cmd[FD_RAW_CMD_SIZE]; unsigned char reply_count; - unsigned char reply[16]; + unsigned char reply[FD_RAW_REPLY_SIZE]; int track; int resultcode; From patchwork Fri May 1 13:44:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Denis Efremov (Oracle)" X-Patchwork-Id: 11522569 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E7F5214B4 for ; Fri, 1 May 2020 13:46:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D999C20757 for ; Fri, 1 May 2020 13:46:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730350AbgEANqC (ORCPT ); Fri, 1 May 2020 09:46:02 -0400 Received: from mail-lj1-f196.google.com ([209.85.208.196]:34617 "EHLO mail-lj1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731899AbgEANpQ (ORCPT ); Fri, 1 May 2020 09:45:16 -0400 Received: by mail-lj1-f196.google.com with SMTP id f11so2677317ljp.1; Fri, 01 May 2020 06:45:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=B1dBZygdOuEOVVgRDxzrxsbu/gYOSkCw10Yi3BStOb4=; b=nhF7S23Y/ZJo0T5XTS8G/hjloPB2T52myLZuRnIGr+uVidboPKqGYmLGRMYw3yTeX4 D8MbshqU3fKZEFG3qXOuFzZcMeUbZWkQkwOhYAnS8Y6YTjTkRhFTIH8LsNCLf+djiI3C rXHo3jiJvCVPkk6TXbHgjCiK+5ZjlfEYeB8oRNjXXr9mz0i4487FxLcneML0ZkvIEgsH fPdy9V/37jDYvFPEXQeU5NFxyFh4kLl7RXRDYfoo+y7FFGLSN0kmF9sWlWdx1hubjVwQ m1j9RQHkHND1WsPaaCJIxMJVBaUBMYNivSl4KfmChn26+9Zmim48dxkwkQXLm+/UOpPr rxvQ== X-Gm-Message-State: AGi0PubTuHdHGkr/U55JgAy0DSnQLP84qRm4AWyRSZ4pzttsw7sfYZuK uliy3LhSFmhf6s1cVJWA13X4Ars1zHg= X-Google-Smtp-Source: APiQypInacq2l4k+DFDSlOyzVO50Ra94dXuWronVpuTuWv/pg1lpXsHb9rnMxjf94v3FqxocLu8ipQ== X-Received: by 2002:a2e:731a:: with SMTP id o26mr2570638ljc.189.1588340714141; Fri, 01 May 2020 06:45:14 -0700 (PDT) Received: from localhost.localdomain ([213.87.150.177]) by smtp.googlemail.com with ESMTPSA id b2sm2269194lfi.14.2020.05.01.06.45.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2020 06:45:13 -0700 (PDT) From: Denis Efremov To: linux-block@vger.kernel.org Cc: Denis Efremov , Willy Tarreau , Christoph Hellwig , Joe Perches , linux-kernel@vger.kernel.org, Christoph Hellwig Subject: [PATCH v3 4/4] floppy: suppress UBSAN warning in setup_rw_floppy() Date: Fri, 1 May 2020 16:44:16 +0300 Message-Id: <20200501134416.72248-5-efremov@linux.com> X-Mailer: git-send-email 2.25.3 In-Reply-To: <20200501134416.72248-1-efremov@linux.com> References: <20200501134416.72248-1-efremov@linux.com> MIME-Version: 1.0 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45 index 16 is out of range for type 'unsigned char [16]' Call Trace: ... setup_rw_floppy+0x5c3/0x7f0 floppy_ready+0x2be/0x13b0 process_one_work+0x2c1/0x5d0 worker_thread+0x56/0x5e0 kthread+0x122/0x170 ret_from_fork+0x35/0x40 From include/uapi/linux/fd.h: struct floppy_raw_cmd { ... unsigned char cmd_count; unsigned char cmd[16]; unsigned char reply_count; unsigned char reply[16]; ... } This out-of-bounds access is intentional. The command in struct floppy_raw_cmd may take up the space initially intended for the reply and the reply count. It is needed for long 82078 commands such as RESTORE, which takes 17 command bytes. Initial cmd size is not enough and since struct setup_rw_floppy is a part of uapi we check that cmd_count is in [0:16+1+16] in raw_cmd_copyin(). The patch adds union with original cmd,reply_count,reply fields and fullcmd field of equivalent size. The cmd accesses are turned to fullcmd where appropriate to suppress UBSAN warning. Reviewed-by: Christoph Hellwig Signed-off-by: Denis Efremov --- drivers/block/floppy.c | 4 ++-- include/uapi/linux/fd.h | 11 ++++++++--- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 9e098d53b046..064c1acb9f00 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -1070,7 +1070,7 @@ static void setup_DMA(void) if (raw_cmd->length == 0) { print_hex_dump(KERN_INFO, "zero dma transfer size: ", DUMP_PREFIX_NONE, 16, 1, - raw_cmd->cmd, raw_cmd->cmd_count, false); + raw_cmd->fullcmd, raw_cmd->cmd_count, false); cont->done(0); fdc_state[current_fdc].reset = 1; return; @@ -1515,7 +1515,7 @@ static void setup_rw_floppy(void) r = 0; for (i = 0; i < raw_cmd->cmd_count; i++) - r |= output_byte(current_fdc, raw_cmd->cmd[i]); + r |= output_byte(current_fdc, raw_cmd->fullcmd[i]); debugt(__func__, "rw_command"); diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h index 2e9c2c1c18e6..8b80c63b971c 100644 --- a/include/uapi/linux/fd.h +++ b/include/uapi/linux/fd.h @@ -371,9 +371,14 @@ struct floppy_raw_cmd { */ unsigned char cmd_count; - unsigned char cmd[FD_RAW_CMD_SIZE]; - unsigned char reply_count; - unsigned char reply[FD_RAW_REPLY_SIZE]; + union { + struct { + unsigned char cmd[FD_RAW_CMD_SIZE]; + unsigned char reply_count; + unsigned char reply[FD_RAW_REPLY_SIZE]; + }; + unsigned char fullcmd[FD_RAW_CMD_FULLSIZE]; + }; int track; int resultcode;