[PATCH 0/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[PATCH 0/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Denis Efremov]

These patches are based on Willy's cleanup patches
https://lkml.org/lkml/2020/3/31/609.

The first two patches indroduce defines to make it more clear why
cmd_count in struct floppy_raw_cmd allows cross-boundary access for
cmd, reply_count, reply fields. The last one handles the warning.

Denis Efremov (3):
  floppy: add FD_AUTODETECT_SIZE define for struct floppy_drive_params
  floppy: add defines for sizes of cmd & reply buffers of floppy_raw_cmd
  floppy: suppress UBSAN warning in setup_rw_floppy()

 drivers/block/floppy.c  | 29 +++++++++++++++++------------
 include/uapi/linux/fd.h | 13 ++++++++++---
 2 files changed, 27 insertions(+), 15 deletions(-)

-- 
2.25.3

[PATCH 1/3] floppy: add FD_AUTODETECT_SIZE define for struct floppy_drive_params

[Denis Efremov]

Use FD_AUTODETECT_SIZE for autodetect buffer size in struct
floppy_drive_params instead of a magic number.

Signed-off-by: Denis Efremov <efremov@linux.com>
---
 drivers/block/floppy.c  | 9 +++++----
 include/uapi/linux/fd.h | 5 ++++-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 2817170dd403..ac2023c757e3 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -2076,7 +2076,8 @@ static int next_valid_format(int drive)
 
 	probed_format = drive_state[drive].probed_format;
 	while (1) {
-		if (probed_format >= 8 || !drive_params[drive].autodetect[probed_format]) {
+		if (probed_format >= FD_AUTODETECT_SIZE ||
+			!drive_params[drive].autodetect[probed_format]) {
 			drive_state[drive].probed_format = 0;
 			return 1;
 		}
@@ -3445,13 +3446,13 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 	return 0;
 }
 
-static bool valid_floppy_drive_params(const short autodetect[8],
+static bool valid_floppy_drive_params(const short autodetect[FD_AUTODETECT_SIZE],
 		int native_format)
 {
 	size_t floppy_type_size = ARRAY_SIZE(floppy_type);
 	size_t i = 0;
 
-	for (i = 0; i < 8; ++i) {
+	for (i = 0; i < FD_AUTODETECT_SIZE; ++i) {
 		if (autodetect[i] < 0 ||
 		    autodetect[i] >= floppy_type_size)
 			return false;
@@ -3676,7 +3677,7 @@ struct compat_floppy_drive_params {
 	struct floppy_max_errors max_errors;
 	char		flags;
 	char		read_track;
-	short		autodetect[8];
+	short		autodetect[FD_AUTODETECT_SIZE];
 	compat_int_t	checkfreq;
 	compat_int_t	native_format;
 };
diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h
index 90fb94712c41..f5cb0aa8cebc 100644
--- a/include/uapi/linux/fd.h
+++ b/include/uapi/linux/fd.h
@@ -172,7 +172,10 @@ struct floppy_drive_params {
  * used in succession to try to read the disk. If the FDC cannot lock onto
  * the disk, the next format is tried. This uses the variable 'probing'.
  */
-	short autodetect[8];		/* autodetected formats */
+
+#define FD_AUTODETECT_SIZE 8
+
+	short autodetect[FD_AUTODETECT_SIZE];		/* autodetected formats */
 	
 	int checkfreq; /* how often should the drive be checked for disk 
 			* changes */
-- 
2.25.3

[PATCH 2/3] floppy: add defines for sizes of cmd & reply buffers of floppy_raw_cmd

[Denis Efremov]

Use FD_RAW_CMD_SIZE, FD_RAW_REPLY_SIZE defines instead of magic numbers
for cmd & reply buffers of struct floppy_raw_cmd. Remove local to
floppy.c MAX_REPLIES define, as it is now FD_RAW_REPLY_SIZE.

Signed-off-by: Denis Efremov <efremov@linux.com>
---
 drivers/block/floppy.c  | 15 ++++++++-------
 include/uapi/linux/fd.h |  8 ++++++--
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index ac2023c757e3..2169df796d18 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -337,8 +337,7 @@ static bool initialized;
 /*
  * globals used by 'result()'
  */
-#define MAX_REPLIES 16
-static unsigned char reply_buffer[MAX_REPLIES];
+static unsigned char reply_buffer[FD_RAW_REPLY_SIZE];
 static int inr;		/* size of reply buffer, when called from interrupt */
 #define ST0		0
 #define ST1		1
@@ -1165,7 +1164,7 @@ static int result(int fdc)
 	int i;
 	int status = 0;
 
-	for (i = 0; i < MAX_REPLIES; i++) {
+	for (i = 0; i < FD_RAW_REPLY_SIZE; i++) {
 		status = wait_til_ready(fdc);
 		if (status < 0)
 			break;
@@ -1847,7 +1846,7 @@ static void show_floppy(int fdc)
 			output_log[(i + output_log_pos) % OLOGSIZE].jiffies);
 	pr_info("last result at %lu\n", resultjiffies);
 	pr_info("last redo_fd_request at %lu\n", lastredo);
-	print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1,
+	print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, FD_RAW_REPLY_SIZE, 1,
 		       reply_buffer, resultsize, true);
 
 	pr_info("status=%x\n", fdc_inb(fdc, FD_STATUS));
@@ -3082,7 +3081,7 @@ static void raw_cmd_done(int flag)
 		raw_cmd->flags |= FD_RAW_HARDFAILURE;
 	} else {
 		raw_cmd->reply_count = inr;
-		if (raw_cmd->reply_count > MAX_REPLIES)
+		if (raw_cmd->reply_count > FD_RAW_REPLY_SIZE)
 			raw_cmd->reply_count = 0;
 		for (i = 0; i < raw_cmd->reply_count; i++)
 			raw_cmd->reply[i] = reply_buffer[i];
@@ -3193,7 +3192,9 @@ static int raw_cmd_copyin(int cmd, void __user *param,
 	if (ret)
 		return -EFAULT;
 	param += sizeof(struct floppy_raw_cmd);
-	if (ptr->cmd_count > 33)
+	if (ptr->cmd_count > FD_RAW_CMD_SIZE +
+			     sizeof_field(struct floppy_raw_cmd, reply_count) +
+			     FD_RAW_REPLY_SIZE)
 			/* the command may now also take up the space
 			 * initially intended for the reply & the
 			 * reply count. Needed for long 82078 commands
@@ -3204,7 +3205,7 @@ static int raw_cmd_copyin(int cmd, void __user *param,
 			 */
 		return -EINVAL;
 
-	for (i = 0; i < 16; i++)
+	for (i = 0; i < FD_RAW_REPLY_SIZE; i++)
 		ptr->reply[i] = 0;
 	ptr->resultcode = 0;
 
diff --git a/include/uapi/linux/fd.h b/include/uapi/linux/fd.h
index f5cb0aa8cebc..d3961b52cb9a 100644
--- a/include/uapi/linux/fd.h
+++ b/include/uapi/linux/fd.h
@@ -360,10 +360,14 @@ struct floppy_raw_cmd {
 	int buffer_length; /* length of allocated buffer */
 
 	unsigned char rate;
+
+#define FD_RAW_CMD_SIZE 16
+#define FD_RAW_REPLY_SIZE 16
+
 	unsigned char cmd_count;
-	unsigned char cmd[16];
+	unsigned char cmd[FD_RAW_CMD_SIZE];
 	unsigned char reply_count;
-	unsigned char reply[16];
+	unsigned char reply[FD_RAW_REPLY_SIZE];
 	int track;
 	int resultcode;
 
-- 
2.25.3

[PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Denis Efremov]

UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45
index 16 is out of range for type 'unsigned char [16]'
Call Trace:
...
 setup_rw_floppy+0x5c3/0x7f0
 floppy_ready+0x2be/0x13b0
 process_one_work+0x2c1/0x5d0
 worker_thread+0x56/0x5e0
 kthread+0x122/0x170
 ret_from_fork+0x35/0x40

From include/uapi/linux/fd.h:
struct floppy_raw_cmd {
	...
	unsigned char cmd_count;
	unsigned char cmd[16];
	unsigned char reply_count;
	unsigned char reply[16];
	...
}

This out-of-bounds access is intentional. The command in struct
floppy_raw_cmd may take up the space initially intended for the reply
and the reply count. It is needed for long 82078 commands such as
RESTORE, which takes 17 command bytes. Initial cmd size is not enough
and since struct setup_rw_floppy is a part of uapi we check that
cmd_count is in [0:16+1+16] in raw_cmd_copyin().

The patch replaces array subscript with pointer arithetic to suppress
UBSAN warning.

Signed-off-by: Denis Efremov <efremov@linux.com>
---
 drivers/block/floppy.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 2169df796d18..63981b1f8d4c 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -1518,7 +1518,10 @@ static void setup_rw_floppy(void)
 
 	r = 0;
 	for (i = 0; i < raw_cmd->cmd_count; i++)
-		r |= output_byte(current_fdc, raw_cmd->cmd[i]);
+		/* The command may take up the space initially intended for the
+		 * reply and the reply count.
+		 */
+		r |= output_byte(current_fdc, *(raw_cmd->cmd + i));
 
 	debugt(__func__, "rw_command");
 
-- 
2.25.3

Re: [PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Christoph Hellwig]

On Tue, Apr 21, 2020 at 03:57:22PM +0300, Denis Efremov wrote:
> UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45
> index 16 is out of range for type 'unsigned char [16]'
> Call Trace:
> ...
>  setup_rw_floppy+0x5c3/0x7f0
>  floppy_ready+0x2be/0x13b0
>  process_one_work+0x2c1/0x5d0
>  worker_thread+0x56/0x5e0
>  kthread+0x122/0x170
>  ret_from_fork+0x35/0x40
> 
> >From include/uapi/linux/fd.h:
> struct floppy_raw_cmd {
> 	...
> 	unsigned char cmd_count;
> 	unsigned char cmd[16];
> 	unsigned char reply_count;
> 	unsigned char reply[16];
> 	...
> }
> 
> This out-of-bounds access is intentional. The command in struct
> floppy_raw_cmd may take up the space initially intended for the reply
> and the reply count. It is needed for long 82078 commands such as
> RESTORE, which takes 17 command bytes. Initial cmd size is not enough
> and since struct setup_rw_floppy is a part of uapi we check that
> cmd_count is in [0:16+1+16] in raw_cmd_copyin().
> 
> The patch replaces array subscript with pointer arithetic to suppress
> UBSAN warning.

Urghh.  I think the better way would be to use a union that creates
a larger cmd field, or something like:

struct floppy_raw_cmd {
	...
	u8 buf[34];

#define BUF_CMD_COUNT	0
#define BUF_CMD		1
#define BUF_REPLY_COUNT	17
#define BUF_REPLY	18

and use addressing based on that.

Re: [PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Willy Tarreau]

On Wed, Apr 22, 2020 at 12:09:21AM -0700, Christoph Hellwig wrote:
> On Tue, Apr 21, 2020 at 03:57:22PM +0300, Denis Efremov wrote:
> > UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45
> > index 16 is out of range for type 'unsigned char [16]'
> > Call Trace:
> > ...
> >  setup_rw_floppy+0x5c3/0x7f0
> >  floppy_ready+0x2be/0x13b0
> >  process_one_work+0x2c1/0x5d0
> >  worker_thread+0x56/0x5e0
> >  kthread+0x122/0x170
> >  ret_from_fork+0x35/0x40
> > 
> > >From include/uapi/linux/fd.h:
> > struct floppy_raw_cmd {
> > 	...
> > 	unsigned char cmd_count;
> > 	unsigned char cmd[16];
> > 	unsigned char reply_count;
> > 	unsigned char reply[16];
> > 	...
> > }
> > 
> > This out-of-bounds access is intentional. The command in struct
> > floppy_raw_cmd may take up the space initially intended for the reply
> > and the reply count. It is needed for long 82078 commands such as
> > RESTORE, which takes 17 command bytes. Initial cmd size is not enough
> > and since struct setup_rw_floppy is a part of uapi we check that
> > cmd_count is in [0:16+1+16] in raw_cmd_copyin().
> > 
> > The patch replaces array subscript with pointer arithetic to suppress
> > UBSAN warning.
> 
> Urghh.  I think the better way would be to use a union that creates
> a larger cmd field, or something like:
> 
> struct floppy_raw_cmd {
> 	...
> 	u8 buf[34];
> 
> #define BUF_CMD_COUNT	0
> #define BUF_CMD		1
> #define BUF_REPLY_COUNT	17
> #define BUF_REPLY	18
> 
> and use addressing based on that.

But isn't it a problem if struct floppy_raw_cmd is exposed to uapi ?
That said I remember a discussion with Linus who said that most if not
all of the floppy parts leaking to uapi were more of a side effect of
the include files reordering than a deliberate decision to expose it.
So maybe that could remain the best solution indeed.

I must say I don't feel very comfortable either with replacing p[i]
with *(p+i) given that they are all supposed to be interchangeable and
equivalent (as well as i[p] as strange as it can look). So we're not
really protected against a later mechanical change or cleanup that
reintroduces it :-/

Willy

Re: [PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Denis Efremov]

On 4/22/20 10:17 AM, Willy Tarreau wrote:
> On Wed, Apr 22, 2020 at 12:09:21AM -0700, Christoph Hellwig wrote:
>> On Tue, Apr 21, 2020 at 03:57:22PM +0300, Denis Efremov wrote:
>>> UBSAN: array-index-out-of-bounds in drivers/block/floppy.c:1521:45
>>> index 16 is out of range for type 'unsigned char [16]'
>>> Call Trace:
>>> ...
>>>  setup_rw_floppy+0x5c3/0x7f0
>>>  floppy_ready+0x2be/0x13b0
>>>  process_one_work+0x2c1/0x5d0
>>>  worker_thread+0x56/0x5e0
>>>  kthread+0x122/0x170
>>>  ret_from_fork+0x35/0x40
>>>
>>> >From include/uapi/linux/fd.h:
>>> struct floppy_raw_cmd {
>>> 	...
>>> 	unsigned char cmd_count;
>>> 	unsigned char cmd[16];
>>> 	unsigned char reply_count;
>>> 	unsigned char reply[16];
>>> 	...
>>> }
>>>
>>> This out-of-bounds access is intentional. The command in struct
>>> floppy_raw_cmd may take up the space initially intended for the reply
>>> and the reply count. It is needed for long 82078 commands such as
>>> RESTORE, which takes 17 command bytes. Initial cmd size is not enough
>>> and since struct setup_rw_floppy is a part of uapi we check that
>>> cmd_count is in [0:16+1+16] in raw_cmd_copyin().
>>>
>>> The patch replaces array subscript with pointer arithetic to suppress
>>> UBSAN warning.
>>
> 
> But isn't it a problem if struct floppy_raw_cmd is exposed to uapi ?
> That said I remember a discussion with Linus who said that most if not
> all of the floppy parts leaking to uapi were more of a side effect of
> the include files reordering than a deliberate decision to expose it.
> So maybe that could remain the best solution indeed.

struct floppy_raw_cmd is input/output structure for FDRAWCMD ioctl.

> 
> I must say I don't feel very comfortable either with replacing p[i]
> with *(p+i) given that they are all supposed to be interchangeable and
> equivalent (as well as i[p] as strange as it can look). So we're not
> really protected against a later mechanical change or cleanup that
> reintroduces it :-/

>> Urghh.  I think the better way would be to use a union that creates
>> a larger cmd field, or something like:
>>
>> struct floppy_raw_cmd {
>> 	...
>> 	u8 buf[34];
>>
>> #define BUF_CMD_COUNT	0
>> #define BUF_CMD		1
>> #define BUF_REPLY_COUNT	17
>> #define BUF_REPLY	18
>>
>> and use addressing based on that.


What do you think about changing it this way?

struct floppy_raw_cmd {
 
        unsigned char rate;
 
-#define FD_RAW_CMD_SIZE 16
+#define FD_RAW_CMD_SIZE 33
 #define FD_RAW_REPLY_SIZE 16
 
        unsigned char cmd_count;
-       unsigned char cmd[FD_RAW_CMD_SIZE];
-       unsigned char reply_count;
-       unsigned char reply[FD_RAW_REPLY_SIZE];
+       union {
+               struct {
+                       unsigned char reserved[16];
+                       unsigned char reply_count;
+                       unsigned char reply[FD_RAW_REPLY_SIZE];
+               };
+               unsigned char cmd[FD_RAW_CMD_SIZE];
+       };
        int track;

Denis

Re: [PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Christoph Hellwig]

On Wed, Apr 22, 2020 at 11:20:23AM +0300, Denis Efremov wrote:
> What do you think about changing it this way?
> 
> struct floppy_raw_cmd {
>  
>         unsigned char rate;
>  
> -#define FD_RAW_CMD_SIZE 16
> +#define FD_RAW_CMD_SIZE 33
>  #define FD_RAW_REPLY_SIZE 16
>  
>         unsigned char cmd_count;
> -       unsigned char cmd[FD_RAW_CMD_SIZE];
> -       unsigned char reply_count;
> -       unsigned char reply[FD_RAW_REPLY_SIZE];
> +       union {
> +               struct {
> +                       unsigned char reserved[16];
> +                       unsigned char reply_count;
> +                       unsigned char reply[FD_RAW_REPLY_SIZE];
> +               };
> +               unsigned char cmd[FD_RAW_CMD_SIZE];
> +       };

I don't think we can just change FD_RAW_CMD_SIZE or cmd as that could
break userspace. But otherwise, yes something very much like that:

>  #define FD_RAW_CMD_SIZE 16
>  #define FD_RAW_REPLY_SIZE 16
> +#define FD_RAW_FULL_CMD_SIZE (FD_RAW_CMD_SIZE + 1 + FD_RAW_CMD_SIZE)
>  
>         unsigned char cmd_count;
> -       unsigned char cmd[FD_RAW_CMD_SIZE];
> -       unsigned char reply_count;
> -       unsigned char reply[FD_RAW_REPLY_SIZE];
> +       union {
> +               struct {
> +                       unsigned char cmd[FD_RAW_CMD_SIZE];
> +                       unsigned char reply_count;
> +                       unsigned char reply[FD_RAW_REPLY_SIZE];
> +               };
> +               unsigned char full_cmd[FD_RAW_FULL_CMD_SIZE];
> +       };

>         int track;
> 
> Denis
---end quoted text---

Re: [PATCH 3/3] floppy: suppress UBSAN warning in setup_rw_floppy()

[Denis Efremov]

On 4/22/20 11:24 AM, Christoph Hellwig wrote:
> 
> I don't think we can just change FD_RAW_CMD_SIZE or cmd as that could
> break userspace.

The second patch adds these defines FD_RAW_CMD_SIZE, FD_RAW_REPLY_SIZE.
Currently they are not in the uapi. Ok, I will send v2.

But otherwise, yes something very much like that:
> 
>>  #define FD_RAW_CMD_SIZE 16
>>  #define FD_RAW_REPLY_SIZE 16
>> +#define FD_RAW_FULL_CMD_SIZE (FD_RAW_CMD_SIZE + 1 + FD_RAW_CMD_SIZE)
>>  
>>         unsigned char cmd_count;
>> -       unsigned char cmd[FD_RAW_CMD_SIZE];
>> -       unsigned char reply_count;
>> -       unsigned char reply[FD_RAW_REPLY_SIZE];
>> +       union {
>> +               struct {
>> +                       unsigned char cmd[FD_RAW_CMD_SIZE];
>> +                       unsigned char reply_count;
>> +                       unsigned char reply[FD_RAW_REPLY_SIZE];
>> +               };
>> +               unsigned char full_cmd[FD_RAW_FULL_CMD_SIZE];
>> +       };
> 
>>         int track;
>>
>> Denis
> ---end quoted text---
>