Re: [PATCH] scsi: reject negative SG_SET_TIMEOUT values

[Bart Van Assche]

On 10/17/26 1:45 AM, Wang Yingjie wrote:
> The block SCSI path predates Git history. The BSG path has exposed the
> same behavior since BSG was introduced.
>
> Fixes: 3d6392cfbd7d ("bsg: support for full generic block layer SG v3")

As mentioned above this issue is older than when Linus started using git
so I think it would be appropriate to add the following:

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

> diff --git a/block/bsg.c b/block/bsg.c
> index 82aaf3cee582..681da79a5ba2 100644
> --- a/block/bsg.c
> +++ b/block/bsg.c
> @@ -132,6 +132,8 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>   	case SG_SET_TIMEOUT:
>   		if (get_user(val, intp))
>   			return -EFAULT;
> +		if (val < 0)
> +			return -EIO;
>   		bd->timeout = clock_t_to_jiffies(val);
>   		return 0;
>   	case SG_GET_TIMEOUT:
> diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
> index c14f81403a09..162a21112d49 100644
> --- a/drivers/scsi/scsi_ioctl.c
> +++ b/drivers/scsi/scsi_ioctl.c
> @@ -195,10 +195,13 @@ static int sg_set_timeout(struct scsi_device *sdev, int __user *p)
>   {
>   	int timeout, err = get_user(timeout, p);
>   
> -	if (!err)
> -		sdev->sg_timeout = clock_t_to_jiffies(timeout);
> +	if (err)
> +		return err;
> +	if (timeout < 0)
> +		return -EIO;
>   
> -	return err;
> +	sdev->sg_timeout = clock_t_to_jiffies(timeout);
> +	return 0;
>   }

Rejecting negative values with -EIO matches drivers/scsi/sg.c, which
looks good. However, large positive int values still overflow
bd->timeout and sdev->sg_timeout: both fields are 32-bit unsigned int 
while clock_t_to_jiffies() returns unsigned long (clamping only at
ULONG_MAX).

Bart.