Skip to content

Commit

Permalink
ide-cd: fix oops when using growisofs
Browse files Browse the repository at this point in the history
cdrom_read_capacity() will blindly return the capacity from the device
without sanity-checking it.  This later causes code in fs/buffer.c to
oops.

Fix this by checking that the device is telling us sensible things.

From: Jens Axboe <jens.axboe@oracle.com>
Cc: Michael Buesch <mb@bu3sch.de>
Cc: Jan Kara <jack@suse.cz>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@kernel.org>
Cc: Borislav Petkov <petkovbb@googlemail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[bart: print device name instead of driver name]
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
[harvey: blocklen is a big-endian value]
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
  • Loading branch information
Jens Axboe authored and Bartlomiej Zolnierkiewicz committed Jul 24, 2008
1 parent 96cc112 commit e8e7b9e
Showing 1 changed file with 22 additions and 5 deletions.
27 changes: 22 additions & 5 deletions drivers/ide/ide-cd.c
Original file line number Diff line number Diff line change
Expand Up @@ -1311,13 +1311,30 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,

stat = ide_cd_queue_pc(drive, cmd, 0, &capbuf, &len, sense, 0,
REQ_QUIET);
if (stat == 0) {
*capacity = 1 + be32_to_cpu(capbuf.lba);
*sectors_per_frame =
be32_to_cpu(capbuf.blocklen) >> SECTOR_BITS;
if (stat)
return stat;

/*
* Sanity check the given block size
*/
switch (capbuf.blocklen) {
case __constant_cpu_to_be32(512):
case __constant_cpu_to_be32(1024):
case __constant_cpu_to_be32(2048):
case __constant_cpu_to_be32(4096):
break;
default:
printk(KERN_ERR "%s: weird block size %u\n",
drive->name, capbuf.blocklen);
printk(KERN_ERR "%s: default to 2kb block size\n",
drive->name);
capbuf.blocklen = __constant_cpu_to_be32(2048);
break;
}

return stat;
*capacity = 1 + be32_to_cpu(capbuf.lba);
*sectors_per_frame = be32_to_cpu(capbuf.blocklen) >> SECTOR_BITS;
return 0;
}

static int cdrom_read_tocentry(ide_drive_t *drive, int trackno, int msf_flag,
Expand Down

0 comments on commit e8e7b9e

Please sign in to comment.