Re: UBSAN: Undefined behaviour in drivers/block/floppy.c:1495:32
From: Kyungtae Kim
Date: Fri Oct 26 2018 - 09:23:06 EST
I corrected the patch as follows:
[PATCH] floppy: Avoid memory access beyond the array bounds in setup_rw_floppy()
setup_rw_floppy() writes some bytes of array cmd to the floppy disk
controller, depending on cmd_count.
Although the size of array cmd is fixed like 16, cmd_count can be much
larger through raw_cmd_ioctl().
Noticed there is no bound check for this, thereby leading to invalid
This patch adds a bound check for cmd_count when initialized for the
The crash log is as follows:
UBSAN: Undefined behaviour in drivers/block/floppy.c:1495:32
index 16 is out of range for type 'unsigned char '
CPU: 0 PID: 2420 Comm: kworker/u4:3 Not tainted 4.19.0-rc2 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: floppy fd_timer_workfn
__dump_stack lib/dump_stack.c:77 [inline]
seek_floppy drivers/block/floppy.c:1605 [inline]
Signed-off-by: Kyungtae Kim <kt0755@xxxxxxxxx>
drivers/block/floppy.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index a8cfa01..41160a1 100644
@@ -3146,6 +3146,9 @@ static int raw_cmd_copyin(int cmd, void __user *param,
+ if (ptr->cmd_count > ARRAY_SIZE(ptr->cmd))
+ return -EINVAL;
for (i = 0; i < 16; i++)
ptr->reply[i] = 0;
ptr->resultcode = 0;
On Wed, Oct 24, 2018 at 5:27 AM Jens Axboe <axboe@xxxxxxxxx> wrote:
> On 10/24/18 12:33 AM, Kyungtae Kim wrote:
> > Corrected.
> You'll want to read Documentation/process/submitting-patches.rst as
> your patch is lacking in several areas.
> Jens Axboe