# git rev-parse -q --verify 2e90ca68b0d2f5548804f22f0dd61145516171e3^{commit} 2e90ca68b0d2f5548804f22f0dd61145516171e3 already have revision, skipping fetch # git checkout -q -f -B kisskb 2e90ca68b0d2f5548804f22f0dd61145516171e3 # git clean -qxdf # < git log -1 # commit 2e90ca68b0d2f5548804f22f0dd61145516171e3 # Author: Linus Torvalds # Date: Fri Feb 21 12:43:35 2020 -0800 # # floppy: check FDC index for errors before assigning it # # Jordy Zomer reported a KASAN out-of-bounds read in the floppy driver in # wait_til_ready(). # # Which on the face of it can't happen, since as Willy Tarreau points out, # the function does no particular memory access. Except through the FDCS # macro, which just indexes a static allocation through teh current fdc, # which is always checked against N_FDC. # # Except the checking happens after we've already assigned the value. # # The floppy driver is a disgrace (a lot of it going back to my original # horrd "design"), and has no real maintainer. Nobody has the hardware, # and nobody really cares. But it still gets used in virtual environment # because it's one of those things that everybody supports. # # The whole thing should be re-written, or at least parts of it should be # seriously cleaned up. The 'current fdc' index, which is used by the # FDCS macro, and which is often shadowed by a local 'fdc' variable, is a # prime example of how not to write code. # # But because nobody has the hardware or the motivation, let's just fix up # the immediate problem with a nasty band-aid: test the fdc index before # actually assigning it to the static 'fdc' variable. # # Reported-by: Jordy Zomer # Cc: Willy Tarreau # Cc: Dan Carpenter # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux-gcc --version # < /opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux-ld --version # < git log --format=%s --max-count=1 2e90ca68b0d2f5548804f22f0dd61145516171e3 # < make -s -j 24 ARCH=um O=/kisskb/build/linus_um-allmodconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 allmodconfig # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_KCOV=n # Added to kconfig CONFIG_GCC_PLUGINS=n # Added to kconfig CONFIG_GCC_PLUGIN_CYC_COMPLEXITY=n # Added to kconfig CONFIG_GCC_PLUGIN_SANCOV=n # Added to kconfig CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n # Added to kconfig CONFIG_GCC_PLUGIN_STRUCTLEAK=n # Added to kconfig CONFIG_GCC_PLUGIN_RANDSTRUCT=n # Added to kconfig CONFIG_UML_NET=n # Added to kconfig CONFIG_UML_NET_ETHERTAP=n # Added to kconfig CONFIG_UML_NET_TUNTAP=n # Added to kconfig CONFIG_UML_NET_SLIP=n # Added to kconfig CONFIG_UML_NET_DAEMON=n # Added to kconfig CONFIG_UML_NET_VDE=n # Added to kconfig CONFIG_UML_NET_MCAST=n # Added to kconfig CONFIG_UML_NET_PCAP=n # Added to kconfig CONFIG_UML_NET_SLIRP=n # Added to kconfig CONFIG_GCOV_KERNEL=n # Added to kconfig CONFIG_DEBUG_INFO_BTF=n # < make -s -j 24 ARCH=um O=/kisskb/build/linus_um-allmodconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 help # make -s -j 24 ARCH=um O=/kisskb/build/linus_um-allmodconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 olddefconfig .config:4174:warning: override: reassigning to symbol UML_NET_ETHERTAP .config:4176:warning: override: reassigning to symbol UML_NET_SLIP .config:4179:warning: override: reassigning to symbol UML_NET_MCAST .config:4181:warning: override: reassigning to symbol UML_NET_SLIRP # make -s -j 24 ARCH=um O=/kisskb/build/linus_um-allmodconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 /kisskb/src/arch/um/os-Linux/signal.c: In function 'sig_handler_common': /kisskb/src/arch/um/os-Linux/signal.c:51:1: warning: the frame size of 2976 bytes is larger than 2048 bytes [-Wframe-larger-than=] } ^ /kisskb/src/arch/um/os-Linux/signal.c: In function 'timer_real_alarm_handler': /kisskb/src/arch/um/os-Linux/signal.c:95:1: warning: the frame size of 2960 bytes is larger than 2048 bytes [-Wframe-larger-than=] } ^ /kisskb/src/security/apparmor/policy_unpack.c: In function 'unpack_profile': /kisskb/src/security/apparmor/policy_unpack.c:526:9: warning: 'pos' may be used uninitialized in this function [-Wmaybe-uninitialized] str[pos] = ':'; ^ /kisskb/src/security/apparmor/policy_unpack.c:497:14: note: 'pos' was declared here int c, j, pos, size2 = unpack_strdup(e, &str, NULL); ^ /kisskb/src/lib/lz4/lz4hc_compress.c: In function 'LZ4HC_compress_generic': /kisskb/src/lib/lz4/lz4hc_compress.c:579:1: warning: the frame size of 2144 bytes is larger than 2048 bytes [-Wframe-larger-than=] } ^ drivers/reset/reset-brcmstb-rescal.o: In function `brcm_rescal_reset_probe': /kisskb/src/drivers/reset/reset-brcmstb-rescal.c:76: undefined reference to `devm_ioremap_resource' drivers/reset/reset-intel-gw.o: In function `intel_reset_probe': /kisskb/src/drivers/reset/reset-intel-gw.c:185: undefined reference to `devm_platform_ioremap_resource' collect2: error: ld returned 1 exit status make[1]: *** [/kisskb/src/Makefile:1077: vmlinux] Error 1 make: *** [Makefile:179: sub-make] Error 2 Command 'make -s -j 24 ARCH=um O=/kisskb/build/linus_um-allmodconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 ' returned non-zero exit status 2 # rm -rf /kisskb/build/linus_um-allmodconfig_um-x86_64 # Build took: 0:07:10.354875