]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ataflop: potential out of bounds in do_format()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 21 Apr 2021 10:18:35 +0000 (13:18 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 14 May 2021 08:49:59 +0000 (10:49 +0200)
commit07f86aa8f4fe077be1b018cc177eb8c6573e5671
treea9d7c537e417d740e41bb436bdc684233357a219
parent42e4caa93282ade6a143ff320d71062874dd3a5a
ataflop: potential out of bounds in do_format()

[ Upstream commit 1ffec389a6431782a8a28805830b6fae9bf00af1 ]

The function uses "type" as an array index:

q = unit[drive].disk[type]->queue;

Unfortunately the bounds check on "type" isn't done until later in the
function.  Fix this by moving the bounds check to the start.

Fixes: bf9c0538e485 ("ataflop: use a separate gendisk for each media format")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/block/ataflop.c