Vulnerability: In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.
Vulnerability ID: CVE-2019-14284
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-07-26
File: drivers/block/floppy.c
Commit message: floppy: fix div-by-zero in setup_format_params

This fixes a divide by zero error in the setup_format_params function of
the floppy driver.

Two consecutive ioctls can trigger the bug: The first one should set the
drive geometry with such .sect and .rate values for the F_SECT_PER_TRACK
to become zero.  Next, the floppy format operation should be called.

A floppy disk is not required to be inserted.  An unprivileged user
could trigger the bug if the device is accessible.

The patch checks F_SECT_PER_TRACK for a non-zero value in the
set_geometry function.  The proper check should involve a reasonable
upper limit for the .sect and .rate fields, but it could change the
UAPI.

The patch also checks F_SECT_PER_TRACK in the setup_format_params, and
cancels the formatting operation in case of zero.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Denis Efremov

Vulnerable version (before fix):
 static void setup_format_params(int track) 	raw_cmd->kernel_data = floppy_track_buffer; 	raw_cmd->length = 4 * F_SECT_PER_TRACK;  	/* allow for about 30ms for data transport per track */ 	head_shift = (F_SECT_PER_TRACK + 5) / 6;  static int set_geometry(unsigned int cmd, struct floppy_struct *g, 	/* sanity checking for parameters. */ 	if (g->sect <= 0 || 	    g->head <= 0 || 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) || 	    /* check if reserved bits are set */ 	    (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)

Fixed version (after fix):
 static void setup_format_params(int track) 	raw_cmd->kernel_data = floppy_track_buffer; 	raw_cmd->length = 4 * F_SECT_PER_TRACK;  	if (!F_SECT_PER_TRACK) 		return;  	/* allow for about 30ms for data transport per track */ 	head_shift = (F_SECT_PER_TRACK + 5) / 6;  static int set_geometry(unsigned int cmd, struct floppy_struct *g, 	/* sanity checking for parameters. */ 	if (g->sect <= 0 || 	    g->head <= 0 || 	    /* check for zero in F_SECT_PER_TRACK */ 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) || 	    /* check if reserved bits are set */ 	    (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)

Patch:
patch: @@ -2120,6 +2120,9 @@ static void setup_format_params(int track)
 	raw_cmd->kernel_data = floppy_track_buffer;
 	raw_cmd->length = 4 * F_SECT_PER_TRACK;
 
+	if (!F_SECT_PER_TRACK)
+		return;
+
 	/* allow for about 30ms for data transport per track */
 	head_shift = (F_SECT_PER_TRACK + 5) / 6;
 
@@ -3232,6 +3235,8 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 	/* sanity checking for parameters. */
 	if (g->sect <= 0 ||
 	    g->head <= 0 ||
+	    /* check for zero in F_SECT_PER_TRACK */
+	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
 	    /* check if reserved bits are set */
 	    (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
path: drivers/block/floppy.c