| From e7422cac9e36a59a25f03529765bb0f034de92f8 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 21 Apr 2021 13:18:35 +0300 |
| Subject: ataflop: potential out of bounds in do_format() |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| [ Upstream commit 1ffec389a6431782a8a28805830b6fae9bf00af1 ] |
| |
| The function uses "type" as an array index: |
| |
| q = unit[drive].disk[type]->queue; |
| |
| Unfortunately the bounds check on "type" isn't done until later in the |
| function. Fix this by moving the bounds check to the start. |
| |
| Fixes: bf9c0538e485 ("ataflop: use a separate gendisk for each media format") |
| Reported-by: kernel test robot <lkp@intel.com> |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Reviewed-by: Christoph Hellwig <hch@lst.de> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/block/ataflop.c | 11 +++++------ |
| 1 file changed, 5 insertions(+), 6 deletions(-) |
| |
| diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c |
| index 104b713f4055..aed2c2a4f4ea 100644 |
| --- a/drivers/block/ataflop.c |
| +++ b/drivers/block/ataflop.c |
| @@ -729,8 +729,12 @@ static int do_format(int drive, int type, struct atari_format_descr *desc) |
| unsigned long flags; |
| int ret; |
| |
| - if (type) |
| + if (type) { |
| type--; |
| + if (type >= NUM_DISK_MINORS || |
| + minor2disktype[type].drive_types > DriveType) |
| + return -EINVAL; |
| + } |
| |
| q = unit[drive].disk[type]->queue; |
| blk_mq_freeze_queue(q); |
| @@ -742,11 +746,6 @@ static int do_format(int drive, int type, struct atari_format_descr *desc) |
| local_irq_restore(flags); |
| |
| if (type) { |
| - if (type >= NUM_DISK_MINORS || |
| - minor2disktype[type].drive_types > DriveType) { |
| - ret = -EINVAL; |
| - goto out; |
| - } |
| type = minor2disktype[type].index; |
| UDT = &atari_disk_type[type]; |
| } |
| -- |
| 2.30.2 |
| |