linux/drivers
Justin Stitt efb905aeb4 cdrom: rearrange last_media_change check to avoid unintentional overflow
When running syzkaller with the newly reintroduced signed integer wrap
sanitizer we encounter this splat:

[  366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33
[  366.021089] -9223372036854775808 - 346321 cannot be represented in type '__s64' (aka 'long long')
[  366.025894] program syz-executor.4 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  366.027502] CPU: 5 PID: 28472 Comm: syz-executor.7 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1
[  366.027512] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  366.027518] Call Trace:
[  366.027523]  <TASK>
[  366.027533]  dump_stack_lvl+0x93/0xd0
[  366.027899]  handle_overflow+0x171/0x1b0
[  366.038787] ata1.00: invalid multi_count 32 ignored
[  366.043924]  cdrom_ioctl+0x2c3f/0x2d10
[  366.063932]  ? __pm_runtime_resume+0xe6/0x130
[  366.071923]  sr_block_ioctl+0x15d/0x1d0
[  366.074624]  ? __pfx_sr_block_ioctl+0x10/0x10
[  366.077642]  blkdev_ioctl+0x419/0x500
[  366.080231]  ? __pfx_blkdev_ioctl+0x10/0x10
...

Historically, the signed integer overflow sanitizer did not work in the
kernel due to its interaction with `-fwrapv` but this has since been
changed [1] in the newest version of Clang. It was re-enabled in the
kernel with Commit 557f8c582a ("ubsan: Reintroduce signed overflow
sanitizer").

Let's rearrange the check to not perform any arithmetic, thus not
tripping the sanitizer.

Link: https://github.com/llvm/llvm-project/pull/82432 [1]
Closes: https://github.com/KSPP/linux/issues/354
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/lkml/20240507-b4-sio-ata1-v1-1-810ffac6080a@google.com
Reviewed-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/lkml/ZjqU0fbzHrlnad8D@equinox
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/r/20240507222520.1445-2-phil@philpotter.co.uk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2024-05-15 12:59:55 -06:00
..
accel accel/ivpu: Fix deadlock in context_xa 2024-04-08 10:55:01 +02:00
accessibility speakup: Avoid crash on very long word 2024-04-11 14:32:53 +02:00
acpi Merge branch 'acpi-cppc' 2024-04-25 19:25:54 +02:00
amba
android binder: check offset alignment in binder_get_object() 2024-04-11 15:19:12 +02:00
ata ata: libata-core: Allow command duration limits detection for ACS-4 drives 2024-04-13 10:42:28 +09:00
atm atm: fore200e: Convert to platform remove callback returning void 2024-03-07 20:36:32 -08:00
auxdisplay auxdisplay: charlcd: Don't rebuild when CONFIG_PANEL_BOOT_MESSAGE=y 2024-04-11 13:34:29 +03:00
base regmap: Add regmap_read_bypassed() 2024-04-08 14:09:58 +01:00
bcma
block nbd: Fix signal handling 2024-05-14 07:22:35 -06:00
bluetooth Bluetooth: qca: fix firmware check error path 2024-05-03 13:05:55 -04:00
bus This pull request contains Broadcom SoCs drivers for 6.10, please pull 2024-04-30 12:28:42 +02:00
cache cache: sifive_ccache: Silence unused variable warning 2024-04-11 07:28:37 +01:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-05-15 12:59:55 -06:00
cdx cdx: add MSI support for CDX bus 2024-03-07 21:52:03 +00:00
char This update includes the following changes: 2024-05-13 14:53:05 -07:00
clk soc: drivers for 6.10 2024-05-13 08:48:42 -07:00
clocksource A set of updates for clocksource and clockevent drivers: 2024-03-23 14:42:45 -07:00
comedi comedi: vmk80xx: fix incomplete endpoint checking 2024-04-11 15:16:23 +02:00
connector
counter
cpufreq RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
cpuidle RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
crypto This update includes the following changes: 2024-05-13 14:53:05 -07:00
cxl cxl: Fix cxl_endpoint_get_perf_coordinate() support for RCH 2024-04-29 09:03:26 -07:00
dax fs: claw back a few FMODE_* bits 2024-04-07 13:49:02 +02:00
dca
devfreq
dio dio: make dio_bus_type const 2024-03-07 20:37:04 +00:00
dma dmaengine: idxd: Fix oops during rmmod on single-CPU platforms 2024-04-07 17:56:06 +05:30
dma-buf Merge drm/drm-fixes into drm-misc-fixes 2024-03-25 21:11:58 +01:00
dpll dpll: fix dpll_pin_on_pin_register() for multiple parent pins 2024-04-25 08:32:09 -07:00
edac EDAC/synopsys: Fix ECC status and IRQ control race condition 2024-05-06 14:19:07 +02:00
eisa alpha: remove DECpc AXP150 (Jensen) support 2024-05-03 22:09:50 +02:00
extcon
firewire firewire: ohci: fulfill timestamp for some local asynchronous transaction 2024-04-29 18:41:00 +09:00
firmware chrome platform firmware changes for 6.10 2024-05-13 16:48:15 -07:00
fpga fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card 2024-04-26 12:14:28 +08:00
fsi
gnss
gpio gpiolib: cdev: fix uninitialised kfifo 2024-05-10 16:38:27 +02:00
gpu This update includes the following changes: 2024-05-13 14:53:05 -07:00
greybus Char/Misc and other driver subsystem updates for 6.9-rc1 2024-03-21 13:21:31 -07:00
hid HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is enabled 2024-04-12 17:48:53 +02:00
hsi
hte
hv hyperv-fixes for v6.9-rc4 2024-04-11 16:23:56 -07:00
hwmon hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us 2024-05-09 09:37:06 -07:00
hwspinlock hwspinlock: omap: Use index to get hwspinlock pointer 2024-03-05 20:01:14 -08:00
hwtracing
i2c i2c: smbus: fix NULL function pointer dereference 2024-04-27 12:57:57 +02:00
i3c
idle cpuidle: ACPI/intel: fix MWAIT hint target C-state computation 2024-03-05 21:25:18 +01:00
iio iio:imu: adis16475: Fix sync mode setting 2024-04-06 16:46:02 +01:00
infiniband qibfs leak fix 2024-05-09 08:39:10 -07:00
input alpha: cleanups and build fixes 2024-05-13 09:14:57 -07:00
interconnect interconnect fixes for v6.9-rc 2024-04-11 14:44:49 +02:00
iommu iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() 2024-05-10 09:09:55 +02:00
ipack ipack: make ipack_bus_type const 2024-03-07 20:32:47 +00:00
irqchip irqchip/gic-v3-its: Prevent double free on error 2024-04-25 14:30:46 +02:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-04-09 17:01:01 -07:00
leds - Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min 2024-03-14 18:03:09 -07:00
macintosh powerpc updates for 6.9 2024-03-15 17:53:48 -07:00
mailbox imx: add support for i.MX95 ELE/V2X MU 2024-03-13 12:23:36 -07:00
mcb mcb: constify the struct device_type usage 2024-03-07 20:38:15 +00:00
md for-6.10/block-20240511 2024-05-13 13:03:54 -07:00
media media: mediatek: vcodec: support 36 bits physical address 2024-03-26 09:52:59 +01:00
memory memory: mtk-smi: fix module autoloading 2024-04-11 08:22:26 +02:00
memstick MMC core: 2024-03-13 10:59:28 -07:00
message scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings 2024-04-25 10:41:19 -07:00
mfd TTY/Serial driver update for 6.9-rc1 2024-03-21 12:44:10 -07:00
misc hardening updates for 6.10-rc1 2024-05-13 14:14:05 -07:00
mmc MMC host: 2024-04-26 13:17:33 -07:00
most most: core: make mostbus const 2024-03-07 20:32:38 +00:00
mtd There has been OTP support improvements in the NVMEM subsystem, and 2024-04-26 13:05:34 -07:00
mux
net for-6.10/io_uring-20240511 2024-05-13 12:48:06 -07:00
nfc NFC: trf7970a: disable all regulators on removal 2024-04-22 14:19:58 -07:00
ntb
nubus
nvdimm libnvdimm updates for v6.9 2024-03-15 11:58:32 -07:00
nvme nvme updates for Linux 6.10 2024-05-14 09:14:49 -06:00
nvmem nvmem: core: Print error on wrong bits DT property 2024-03-07 20:21:53 +00:00
of STM32 Firewall bus for v6.10, round 1 2024-04-29 22:18:22 +02:00
opp OPP: Extend dev_pm_opp_data with turbo support 2024-03-11 10:39:24 +05:30
parisc parisc: led: Convert to platform remove callback returning void 2024-03-08 10:00:07 +01:00
parport parport: sunbpp: Convert to platform remove callback returning void 2024-03-07 21:50:06 +00:00
pci pci-v6.9-fixes-2 2024-05-08 09:37:58 -07:00
pcmcia pcmcia: cs: make pcmcia_socket_class constant 2024-03-10 09:07:00 +01:00
peci
perf drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported 2024-03-26 14:09:18 -07:00
phy phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered 2024-04-12 16:57:19 +05:30
pinctrl soc: drivers for 6.10 2024-05-13 08:48:42 -07:00
platform chrome platform changes for 6.10 2024-05-13 16:44:47 -07:00
pmdomain Core: 2024-03-13 11:33:10 -07:00
pnp
power power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator 2024-04-15 13:31:37 +02:00
powercap powercap: intel_rapl: Convert to platform remove callback returning void 2024-03-13 20:45:54 +01:00
pps pps: use cflags-y instead of EXTRA_CFLAGS 2024-03-07 21:51:39 +00:00
ps3
ptp Networking changes for 6.9. 2024-03-12 17:44:08 -07:00
pwm pwm: dwc: allow suspend/resume for 16 channels 2024-04-15 17:28:13 +02:00
rapidio
ras RAS: Avoid build errors when CONFIG_DEBUG_FS=n 2024-03-26 21:48:21 +01:00
regulator regulator: core: fix debugfs creation regression 2024-05-09 17:43:57 +02:00
remoteproc remoteproc updates for v6.9 2024-03-21 10:37:39 -07:00
reset reset: k210: Deprecate SOC_CANAAN and use SOC_CANAAN_K210 2024-04-05 16:42:51 +01:00
rpmsg
rtc RTC for 6.9 2024-03-21 17:16:46 -07:00
s390 - Store AP Query Configuration Information in a static buffer 2024-05-13 08:33:52 -07:00
sbus This includes the following changes related to sparc for v6.9: 2024-03-15 12:47:21 -07:00
scsi hardening updates for 6.10-rc1 2024-05-13 14:14:05 -07:00
sh
siox SIOX changes for 6.9-rc1 2024-03-21 15:18:18 -07:00
slimbus slimbus: qcom-ngd-ctrl: Add timeout for wait operation 2024-05-03 07:30:32 +02:00
soc soc: drivers for 6.10 2024-05-13 08:48:42 -07:00
soundwire soundwire: amd: fix for wake interrupt handling for clockstop mode 2024-03-28 23:40:33 +05:30
spi spi: microchip-core-qspi: fix setting spi bus clock rate 2024-05-09 06:59:19 +02:00
spmi
ssb
staging staging: vc04_services: fix information leak in create_component() 2024-03-25 19:10:01 +01:00
target scsi: target: Fix SELinux error when systemd-modules loads the target module 2024-04-05 21:37:54 -04:00
tc
tee TEE driver for Trusted Services 2024-04-29 22:29:44 +02:00
thermal thermal/debugfs: Prevent use-after-free from occurring after cdev removal 2024-04-26 14:57:50 +02:00
thunderbolt thunderbolt: Avoid notify PM core about runtime PM resume 2024-04-10 10:49:58 +03:00
tty alpha: cleanups and build fixes 2024-05-13 09:14:57 -07:00
ufs scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5 2024-04-08 15:06:56 -04:00
uio hyperv-fixes for v6.9-rc4 2024-04-11 16:23:56 -07:00
usb usb: typec: tcpm: Check for port partner validity before consuming it 2024-04-30 19:44:45 +02:00
vdpa vDPA: code clean for vhost_vdpa uapi 2024-04-22 17:07:13 -04:00
vfio VFIO updates for v6.9-rc1 2024-03-15 13:21:13 -07:00
vhost net: extend ubuf_info callback to ops structure 2024-04-22 16:21:35 -07:00
video fbdev: fix incorrect address computation in deferred IO 2024-04-24 15:03:37 +02:00
virt hardening updates for 6.10-rc1 2024-05-13 14:14:05 -07:00
virtio virtio: store owner from modules with register_virtio_driver() 2024-04-08 04:11:04 -04:00
w1
watchdog linux-watchdog 6.9-rc1 tag 2024-03-17 12:06:10 -07:00
xen xen: branch for v6.9-rc1 2024-03-19 08:48:09 -07:00
zorro
Kconfig
Makefile Revert "leds: Only descend into leds directory when CONFIG_NEW_LEDS is set" 2024-03-07 08:48:10 +00:00