Commit 1ffec389 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jens Axboe
Browse files

ataflop: potential out of bounds in do_format() 



The function uses "type" as an array index:

	q = unit[drive].disk[type]->queue;

Unfortunately the bounds check on "type" isn't done until later in the
function.  Fix this by moving the bounds check to the start.

Fixes: bf9c0538 ("ataflop: use a separate gendisk for each media format")
Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 6327c911

drivers/block/ataflop.c

+5 −6
Original line number Diff line number Diff line
@@ -729,8 +729,12 @@ static int do_format(int drive, int type, struct atari_format_descr *desc) 
	unsigned long	flags;

	int ret;



	if (type)

	if (type) {

		type--;

		if (type >= NUM_DISK_MINORS ||

		    minor2disktype[type].drive_types > DriveType)

			return -EINVAL;

	}



	q = unit[drive].disk[type]->queue;

	blk_mq_freeze_queue(q);
@@ -742,11 +746,6 @@ static int do_format(int drive, int type, struct atari_format_descr *desc) 
	local_irq_restore(flags);



	if (type) {

		if (type >= NUM_DISK_MINORS ||

		    minor2disktype[type].drive_types > DriveType) {

			ret = -EINVAL;

			goto out;

		}

		type = minor2disktype[type].index;

		UDT = &atari_disk_type[type];

	}