9fad9d560a
Running syzkaller with the newly reintroduced signed integer overflow
sanitizer produces this report:
[ 65.194362] ------------[ cut here ]------------
[ 65.197752] UBSAN: signed-integer-overflow in ../drivers/scsi/sr_ioctl.c:436:9
[ 65.203607] -2147483648 * 177 cannot be represented in type 'int'
[ 65.207911] CPU: 2 PID: 10416 Comm: syz-executor.1 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1
[ 65.213585] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 65.219923] Call Trace:
[ 65.221556] <TASK>
[ 65.223029] dump_stack_lvl+0x93/0xd0
[ 65.225573] handle_overflow+0x171/0x1b0
[ 65.228219] sr_select_speed+0xeb/0xf0
[ 65.230786] ? __pm_runtime_resume+0xe6/0x130
[ 65.233606] sr_block_ioctl+0x15d/0x1d0
...
Historically, the signed integer overflow sanitizer did not work in the
kernel due to its interaction with `-fwrapv` but this has since been
changed [1] in the newest version of Clang. It was re-enabled in the kernel
with Commit 557f8c582a ("ubsan: Reintroduce signed overflow sanitizer").
Firstly, let's change the type of "speed" to unsigned long as
sr_select_speed()'s only caller passes in an unsigned long anyways.
$ git grep '\.select_speed'
| drivers/scsi/sr.c: .select_speed = sr_select_speed,
...
| static int cdrom_ioctl_select_speed(struct cdrom_device_info *cdi,
| unsigned long arg)
| {
| ...
| return cdi->ops->select_speed(cdi, arg);
| }
Next, let's add an extra check to make sure we don't exceed 0xffff/177
(350) since 0xffff is the max speed. This has two benefits: 1) we deal
with integer overflow before it happens and 2) we properly respect the
max speed of 0xffff. There are some "magic" numbers here but I did not
want to change more than what was necessary.
Link: https://github.com/llvm/llvm-project/pull/82432 [1]
Closes: https://github.com/KSPP/linux/issues/357
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20240508-b4-b4-sio-sr_select_speed-v2-1-00b68f724290@google.com
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
79 lines
2.5 KiB
C
79 lines
2.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* sr.h by David Giller
|
|
* CD-ROM disk driver header file
|
|
*
|
|
* adapted from:
|
|
* sd.h Copyright (C) 1992 Drew Eckhardt
|
|
* SCSI disk driver header file by
|
|
* Drew Eckhardt
|
|
*
|
|
* <drew@colorado.edu>
|
|
*
|
|
* Modified by Eric Youngdale eric@andante.org to
|
|
* add scatter-gather, multiple outstanding request, and other
|
|
* enhancements.
|
|
*/
|
|
|
|
#ifndef _SR_H
|
|
#define _SR_H
|
|
|
|
#include <linux/mutex.h>
|
|
|
|
#define MAX_RETRIES 3
|
|
#define SR_TIMEOUT (30 * HZ)
|
|
|
|
struct scsi_device;
|
|
|
|
/* The CDROM is fairly slow, so we need a little extra time */
|
|
/* In fact, it is very slow if it has to spin up first */
|
|
#define IOCTL_TIMEOUT 30*HZ
|
|
|
|
|
|
typedef struct scsi_cd {
|
|
unsigned capacity; /* size in blocks */
|
|
struct scsi_device *device;
|
|
unsigned int vendor; /* vendor code, see sr_vendor.c */
|
|
unsigned long ms_offset; /* for reading multisession-CD's */
|
|
unsigned writeable : 1;
|
|
unsigned use:1; /* is this device still supportable */
|
|
unsigned xa_flag:1; /* CD has XA sectors ? */
|
|
unsigned readcd_known:1; /* drive supports READ_CD (0xbe) */
|
|
unsigned readcd_cdda:1; /* reading audio data using READ_CD */
|
|
unsigned media_present:1; /* media is present */
|
|
|
|
/* GET_EVENT spurious event handling, blk layer guarantees exclusion */
|
|
int tur_mismatch; /* nr of get_event TUR mismatches */
|
|
bool tur_changed:1; /* changed according to TUR */
|
|
bool get_event_changed:1; /* changed according to GET_EVENT */
|
|
bool ignore_get_event:1; /* GET_EVENT is unreliable, use TUR */
|
|
|
|
struct cdrom_device_info cdi;
|
|
struct mutex lock;
|
|
struct gendisk *disk;
|
|
} Scsi_CD;
|
|
|
|
#define sr_printk(prefix, cd, fmt, a...) \
|
|
sdev_prefix_printk(prefix, (cd)->device, (cd)->cdi.name, fmt, ##a)
|
|
|
|
int sr_do_ioctl(Scsi_CD *, struct packet_command *);
|
|
|
|
int sr_lock_door(struct cdrom_device_info *, int);
|
|
int sr_tray_move(struct cdrom_device_info *, int);
|
|
int sr_drive_status(struct cdrom_device_info *, int);
|
|
int sr_disk_status(struct cdrom_device_info *);
|
|
int sr_get_last_session(struct cdrom_device_info *, struct cdrom_multisession *);
|
|
int sr_get_mcn(struct cdrom_device_info *, struct cdrom_mcn *);
|
|
int sr_reset(struct cdrom_device_info *);
|
|
int sr_select_speed(struct cdrom_device_info *cdi, unsigned long speed);
|
|
int sr_audio_ioctl(struct cdrom_device_info *, unsigned int, void *);
|
|
|
|
int sr_is_xa(Scsi_CD *);
|
|
|
|
/* sr_vendor.c */
|
|
void sr_vendor_init(Scsi_CD *);
|
|
int sr_cd_check(struct cdrom_device_info *);
|
|
int sr_set_blocklength(Scsi_CD *, int blocklength);
|
|
|
|
#endif
|