floppy: use a statically allocated error counter

commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream.

Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
request just to increment the error count.  There's no point keeping
that one in the request anyway, and since the interrupt handler uses a
static pointer to the error which cannot be kept in sync with the
pending request, better make it use a static error counter that's reset
for each new request.  This reset now happens when entering
redo_fd_request() for a new request via set_next_request().

One initial concern about a single error counter was that errors on one
floppy drive could be reported on another one, but this problem is not
real given that the driver uses a single drive at a time, as that
PC-compatible controllers also have this limitation by using shared
signals.  As such the error count is always for the "current" drive.

Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Tested-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 77f84e906326eb8e5897fab9375ee1a15a734490..d352ac941900ba8605691082a0bc49ed0c707656 100644 (file)
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -516,8 +516,8 @@ static unsigned long fdc_busy;
 static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
 static DECLARE_WAIT_QUEUE_HEAD(command_done);
 
-/* Errors during formatting are counted here. */
-static int format_errors;
+/* errors encountered on the current (or last) request */
+static int floppy_errors;
 
 /* Format request descriptor. */
 static struct format_descr format_req;
@@ -537,7 +537,6 @@ static struct format_descr format_req;
 static char *floppy_track_buffer;
 static int max_buffer_sectors;
 
-static int *errors;
 typedef void (*done_f)(int);
 static const struct cont_t {
        void (*interrupt)(void);
@@ -1426,7 +1425,7 @@ static int interpret_errors(void)
                        if (DP->flags & FTD_MSG)
                                DPRINT("Over/Underrun - retrying\n");
                        bad = 0;
-               } else if (*errors >= DP->max_errors.reporting) {
+               } else if (floppy_errors >= DP->max_errors.reporting) {
                        print_errors();
                }
                if (ST2 & ST2_WC || ST2 & ST2_BC)
@@ -2049,7 +2048,7 @@ static void bad_flp_intr(void)
                if (!next_valid_format())
                        return;
        }
-       err_count = ++(*errors);
+       err_count = ++floppy_errors;
        INFBOUND(DRWE->badness, err_count);
        if (err_count > DP->max_errors.abort)
                cont->done(0);
@@ -2194,9 +2193,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
                return -EINVAL;
        }
        format_req = *tmp_format_req;
-       format_errors = 0;
        cont = &format_cont;
-       errors = &format_errors;
+       floppy_errors = 0;
        ret = wait_til_done(redo_format, true);
        if (ret == -EINTR)
                return -EINTR;
@@ -2679,7 +2677,7 @@ static int make_raw_rw_request(void)
                 */
                if (!direct ||
                    (indirect * 2 > direct * 3 &&
-                    *errors < DP->max_errors.read_track &&
+                    floppy_errors < DP->max_errors.read_track &&
                     ((!probing ||
                       (DP->read_track & (1 << DRS->probed_format)))))) {
                        max_size = blk_rq_sectors(current_req);
@@ -2813,7 +2811,7 @@ static int set_next_request(void)
                if (q) {
                        current_req = blk_fetch_request(q);
                        if (current_req) {
-                               current_req->error_count = 0;
+                               floppy_errors = 0;
                                break;
                        }
                }
@@ -2875,7 +2873,6 @@ do_request:
                _floppy = floppy_type + DP->autodetect[DRS->probed_format];
        } else
                probing = 0;
-       errors = &(current_req->error_count);
        tmp = make_raw_rw_request();
        if (tmp < 2) {
                request_done(tmp);