Re: [PATCH] fdc: check drive block device before usage (CVE-2021-20196)

[John Snow]

On 1/23/21 12:52 PM, Alexander Bulekov wrote:
> On 210123 1247, Alexander Bulekov wrote:
> > Hello,
> > Here is a reproducer for this bug found by the OSS-Fuzz fuzzer:
> >
> > cat << EOF | qemu-system-i386 -display none -machine accel=qtest \
> > -m 512M -machine pc -device floppy,unit=1,id=floppy0,drive=disk0 \
> > -drive id=disk0,file=null-co://,file.read-zeroes=on,if=none,format=raw \
> > -qtest stdio
> > outw 0x3f4 0x2500
> > outb 0x3f5 0x81
> > outb 0x3f5 0x0
> > outb 0x3f5 0x0
> > outb 0x3f5 0x0
> > outw 0x3f4 0x0
> > outw 0x3f4 0x4000
> > outw 0x3f4 0x13
> > outb 0x3f5 0x1
> > outw 0x3f2 0x1405
> > outw 0x3f4 0x0
> > EOF
> Oops there's a mistake there. Fixed:
>
> cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest \
> -m 512M -machine pc -device floppy,unit=1,id=floppy0,drive=disk0 \
> -drive id=disk0,file=null-co://,file.read-zeroes=on,if=none,format=raw \
> -qtest stdio
> outw 0x3f4 0x2500
> outb 0x3f5 0x81
> outb 0x3f5 0x0
> outb 0x3f5 0x0
> outb 0x3f5 0x0
> outw 0x3f2 0x14
> outw 0x3f4 0x0
> outw 0x3f4 0x4000
> outw 0x3f4 0x13
> outb 0x3f5 0x1
> outw 0x3f2 0x1405
> outw 0x3f4 0x0
> EOF
>
> > -Alex

This actually still triggers after I apply this patch. It's not the same 
bug, or the patch isn't sufficient to address this bug.

--js