WSL2-Linux-Kernel/drivers/block
Willy Tarreau 233087ca06 floppy: disable FDRAWCMD by default
Minh Yuan reported a concurrency use-after-free issue in the floppy code
between raw_cmd_ioctl and seek_interrupt.

[ It turns out this has been around, and that others have reported the
  KASAN splats over the years, but Minh Yuan had a reproducer for it and
  so gets primary credit for reporting it for this fix   - Linus ]

The problem is, this driver tends to break very easily and nowadays,
nobody is expected to use FDRAWCMD anyway since it was used to
manipulate non-standard formats.  The risk of breaking the driver is
higher than the risk presented by this race, and accessing the device
requires privileges anyway.

Let's just add a config option to completely disable this ioctl and
leave it disabled by default.  Distros shouldn't use it, and only those
running on antique hardware might need to enable it.

Link: https://lore.kernel.org/all/000000000000b71cdd05d703f6bf@google.com/
Link: https://lore.kernel.org/lkml/CAKcFiNC=MfYVW-Jt9A3=FPJpTwCD2PL_ULNCpsCVE5s8ZeBQgQ@mail.gmail.com
Link: https://lore.kernel.org/all/CAEAjamu1FRhz6StCe_55XY5s389ZP_xmCF69k987En+1z53=eg@mail.gmail.com
Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Reported-by: syzbot+8e8958586909d62b6840@syzkaller.appspotmail.com
Reported-by: cruise k <cruise4k@gmail.com>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Tested-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-04-27 09:41:54 -07:00
..
aoe aoe: use bvec_kmap_local in bvcpy 2022-03-04 12:29:20 -07:00
drbd drbd: set QUEUE_FLAG_STABLE_WRITES 2022-04-06 13:07:53 -06:00
mtip32xx for-5.18/block-2022-03-18 2022-03-21 16:48:55 -07:00
null_blk block: null_blk: end timed out poll request 2022-04-14 10:16:33 -06:00
paride Char/Misc and other driver changes for 5.17-rc1 2022-01-14 16:02:28 +01:00
rnbd SCSI misc on 20220324 2022-03-24 19:37:53 -07:00
xen-blkback for-5.18/drivers-2022-04-01 2022-04-01 16:26:57 -07:00
zram zram: use memcpy_from_bvec in zram_bvec_write 2022-03-04 12:29:21 -07:00
Kconfig floppy: disable FDRAWCMD by default 2022-04-27 09:41:54 -07:00
Makefile block: remove the rsxx driver 2021-12-16 10:57:04 -07:00
amiflop.c block: remove the ->rq_disk field in struct request 2021-11-29 06:41:29 -07:00
ataflop.c block: remove the ->rq_disk field in struct request 2021-11-29 06:41:29 -07:00
brd.c brd: remove brd_devices_mutex mutex 2022-01-17 07:19:40 -07:00
floppy.c floppy: disable FDRAWCMD by default 2022-04-27 09:41:54 -07:00
loop.c for-5.18/drivers-2022-04-01 2022-04-01 16:26:57 -07:00
loop.h loop: revert "make autoclear operation asynchronous" 2022-02-11 05:51:23 -07:00
n64cart.c n64cart: convert bi_disk to bi_bdev->bd_disk fix build 2022-03-21 06:34:45 -06:00
nbd.c Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()" 2022-04-02 11:40:23 -06:00
pktcdvd.c SCSI misc on 20220324 2022-03-24 19:37:53 -07:00
ps3disk.c ps3disk: add error handling support for add_disk() 2021-10-30 11:03:37 -06:00
ps3vram.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00
rbd.c block: fix surprise removal for drivers calling blk_set_queue_dying 2022-02-17 07:54:03 -07:00
rbd_types.h libceph, rbd: replace zero-length array with flexible-array 2020-06-01 13:22:53 +02:00
sunvdc.c block: remove genhd.h 2022-02-02 07:49:59 -07:00
swim.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00
swim3.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00
swim_asm.S treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sx8.c block: remove the gendisk argument to blk_execute_rq 2021-11-29 06:41:29 -07:00
virtio_blk.c for-5.18/drivers-2022-03-18 2022-03-21 17:16:01 -07:00
xen-blkfront.c for-5.18/drivers-2022-04-01 2022-04-01 16:26:57 -07:00
z2ram.c block: remove GENHD_FL_EXT_DEVT 2021-11-29 06:38:35 -07:00