Received-SPF: pass (google.com: domain of linux-kernel+bounces-179970-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
To: Justin Stitt <justinstitt@google.com>
Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>,
        "Martin
 K. Petersen" <martin.petersen@oracle.com>,
        Nathan Chancellor
 <nathan@kernel.org>,
        Bill Wendling <morbo@google.com>, linux-scsi@vger.kernel.org,
        linux-kernel@vger.kernel.org, llvm@lists.linux.dev,
        linux-hardening@vger.kernel.org
Subject: Re: [PATCH v2] scsi: sr: fix unintentional arithmetic wraparound
From: "Martin K. Petersen" <martin.petersen@oracle.com>
In-Reply-To: <20240508-b4-b4-sio-sr_select_speed-v2-1-00b68f724290@google.com>
	(Justin Stitt's message of "Wed, 08 May 2024 17:22:51 +0000")
Organization: Oracle Corporation
Message-ID: <yq1msorrx04.fsf@ca-mkp.ca.oracle.com>
References: <20240508-b4-b4-sio-sr_select_speed-v2-1-00b68f724290@google.com>
Date: Wed, 15 May 2024 10:06:29 -0400
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?FAxOtfzZJdResfEB++24d1hIg8HA7Sd4Wn/ghumuigsqHJb12CVIsg93UGOI?=
 =?us-ascii?Q?MA9bxS0Q9PuTSy35mmXleadupdCTl/WRzf4Rn11I0OjFUjjTis+A5Cz6K1PR?=
 =?us-ascii?Q?5kx7aTtUIz4E2Xt9Nk4KI2xXRzrINbZfd+lkk3JPIJg4+S19uHeIDeg1s3N+?=
 =?us-ascii?Q?3auBCzvFeoeGrMVk+HFK8i6VKDII/DIEQB2nzlx86Tj4rFMEoagaDf0rnRaE?=
 =?us-ascii?Q?8Z2eF/V8CFmYPfVjudiai7szS1n+E2Y8TORKNe5XYPzPbuV3qccS2FaIgJ5X?=
 =?us-ascii?Q?4mnjj+Be30GvA6NXflfvG0IMO1mczPJpZFDDKq9capON/fcJhoxzPA1afeTR?=
 =?us-ascii?Q?PVf5USXFtC5/hZXMidSPa2qLG02RstbtjmJRVEshnabdX2iGulX4Z6gNQWjw?=
 =?us-ascii?Q?YtiiIxU/asGKDo93g3kHy9dJTP6cVw1n0p+fHP+JqMeBDTHV5XMtMPYhIgU4?=
 =?us-ascii?Q?sGgblXqogCVMo8Hm2YPccYQ6NG09tdbLuKwxrkUM6jMGENLqvJZtAjeamQq6?=
 =?us-ascii?Q?vqpcaNjHyI3TQyb3XUz7aL8+jk0WY1RWoHg0UzIcx8Tkz0iDVPpkbW9i04Z4?=
 =?us-ascii?Q?SvV4zzuTX/m9xFHAANnGmonP16l1Tb+mxw9Ho4KLbn+nzSiiJjEznyxpIQAW?=
 =?us-ascii?Q?krNFAVHYCDkrwwA8yZ6iILzufSLFJV4Dbk5jrfwUrQodTpIapzU//XFikCL4?=
 =?us-ascii?Q?j7cqMy2+EBJrawLjEFgXPn/P0ooYqwXfv4OZCP+FwIb6F3M45u9EVnMv5AUG?=
 =?us-ascii?Q?zTX7H9f9P5pJYX2sutUwAZWN7DMr3v6kYDBGRJJKoxEFnxGTGZ5CMIGj8ex8?=
 =?us-ascii?Q?rVf364o8jFliyLuqMw7OM/dxsATRcAYzBFZbdOZlntSidQX0/WZ7t0cPu+Ge?=
 =?us-ascii?Q?BdHXDq6yM4kRda1sb2xTJGh44f3gEaGQ9Td3m3EQ0kNIQoWjr6CkJyZMEDK3?=
 =?us-ascii?Q?EzVi2Me6Mjy/EEJREmxgudHl9Kh1PdCp+wgf/2xNueGcGFvtR4/NCsbyaK9H?=
 =?us-ascii?Q?LhYLsJpxfWsntIffPW4REhPC7Zix3PuIvLIL2/Wz9qOye0AzrPsRTWHfdR80?=
 =?us-ascii?Q?Qkx7Ovhh1mf6v1xZuC/WaFe/QyqxXR4O/Z72yxVOky5zNVCDyrjXH5/0PSdI?=
 =?us-ascii?Q?pJ1wTk4mzvS7TXGUXpN/IqkGbUIxKSOmmt7bib5PSZgF4XgSNX1T0YDJxEik?=
 =?us-ascii?Q?xkHvZM1ks84AWSura4ILRa4xmCpshRgN8kDg5X8X5Oafz6vsvXlrCBFGdQnC?=
 =?us-ascii?Q?7ew3X82LcGmcyM4k5iPJl2GG1AyhLCLiEH5SO8GOLL5RU50CJ1KFB2T9L7Y+?=
 =?us-ascii?Q?8UXW9JdLvYcmoCmijRrNTjAM6IA2MGc6inw27FwEwbCc67oVgtwwrMRyt5yP?=
 =?us-ascii?Q?FWOIGpINlyYkcQv2oSjzi9MWVs2V7/eFZwUhs/PSTJixQQV8LXCIRFoHcbqe?=
 =?us-ascii?Q?l3/VITlKwOvaoWV/TDMeLbRoh6AFw/Hb4JB27uTXUCNM7Yrtx3c6k3rNVPuw?=
 =?us-ascii?Q?+F8njq2bW2qlAwahkpS++W9MRzCLJ+CTr/rU6FIe3IlH5hieSL2BTJrPM12Q?=
 =?us-ascii?Q?Chkp4P7dSgJZBXO4gi21JiQd4KmaPyMjbzW8983MHVbxiEU31IBjq5bzILQ7?=
 =?us-ascii?Q?Jw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	Cn1IupjT+l20PQ9WqjoVX3Pj622aQ+J9v3MevO66wpBTnqpMQSrh2SBm6/+Aam2MNaqyvgIirrOMBHWV546oSRTLboGFHQGO9T8szuar7o8fC1DgaU+FKtnJiIS/l2HOvbCUUnjeTI80tqMEgt9H2e4z8Fup3XEZQW0g2dRCUqQiFQX7CMeX1VqKNDg/y3p1Mbp2ccUfU63wxjXJxHk/eqhzxK499xZkKNASjTppRpTpwmrDANnI/TVCnUwg21TbWk+QPECKSqBRCgmy+NPBEaZqKgE7VE0s1edmdIltNcKSvZuaDCLxxchWnnhy9NY6bHiz6y+Mp22y054crN9nV2Po5ybHQS8MnZBQdiqL5Ev32pOmvg30bHKEgHJQKTss2QU5/DVeRa9XSDJXlNIRtsqXp5BMPwYqESaup+AalGbVd059p457ZjpF+KgCNZG+cixk+Fr0UXuzoA/pJZZtFysb/DH2Z5UjJu3hFa3Hu9V6Mfvpngh3YD9Krwy6TQq3F2YmFPLIMTn/TIf1lW+3FNoui+g3zmIqW6oyUBbEummrkcD1VNoOJaaYfdpXVNnq8K3LXwurueEHaa8+DqLdKSCO/W2j2/9wrrE///wIpPY=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4abb97b8-6de1-4c80-d988-08dc74e838dc
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 May 2024 14:06:31.7054
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 17rzR7mQSZb5L7y0giFcUEcXwyzEgmVd5+HYWWD48mdAPrn2zNgzc4RBJiqZKnmYrpQvz0Mpb++dNk/bJgen5NfIppYMeJ7BT9VOMG7S7IY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5019
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-15_07,2024-05-15_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 adultscore=0
 mlxlogscore=983 phishscore=0 malwarescore=0 suspectscore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2405010000 definitions=main-2405150098
X-Proofpoint-ORIG-GUID: 6UCEP_NqqNP1vTu6ziN8Vv1r0R3PJFuE
X-Proofpoint-GUID: 6UCEP_NqqNP1vTu6ziN8Vv1r0R3PJFuE


Justin,

> Running syzkaller with the newly reintroduced signed integer overflow
> sanitizer produces this report:
>
> [   65.194362] ------------[ cut here ]------------
> [   65.197752] UBSAN: signed-integer-overflow in ../drivers/scsi/sr_ioctl.c:436:9
> [   65.203607] -2147483648 * 177 cannot be represented in type 'int'
> [   65.207911] CPU: 2 PID: 10416 Comm: syz-executor.1 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1
> [   65.213585] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   65.219923] Call Trace:
> [   65.221556]  <TASK>
> [   65.223029]  dump_stack_lvl+0x93/0xd0
> [   65.225573]  handle_overflow+0x171/0x1b0
> [   65.228219]  sr_select_speed+0xeb/0xf0
> [   65.230786]  ? __pm_runtime_resume+0xe6/0x130
> [   65.233606]  sr_block_ioctl+0x15d/0x1d0
> ...
>

Applied to 6.10/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering