diff options
| author | Denis Efremov <efremov@ispras.ru> | 2019-07-12 21:55:20 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-07-17 14:45:49 -0700 |
| commit | f3554aeb991214cbfafd17d55e2bfddb50282e32 (patch) | |
| tree | 9c8f08c1c6ce8a52f8bdb047adeba7d4024ea44c /block | |
| parent | 0ecfebd2b52404ae0c54a878c872bb93363ada36 (diff) | |
| download | linux-f3554aeb991214cbfafd17d55e2bfddb50282e32.tar.bz2 | |
floppy: fix div-by-zero in setup_format_params
This fixes a divide by zero error in the setup_format_params function of
the floppy driver.
Two consecutive ioctls can trigger the bug: The first one should set the
drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
to become zero. Next, the floppy format operation should be called.
A floppy disk is not required to be inserted. An unprivileged user
could trigger the bug if the device is accessible.
The patch checks F_SECT_PER_TRACK for a non-zero value in the
set_geometry function. The proper check should involve a reasonable
upper limit for the .sect and .rate fields, but it could change the
UAPI.
The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
cancels the formatting operation in case of zero.
The bug was found by syzkaller.
Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions