Re: [PATCH v3] scsi: handle out-of-range SG_SET_TIMEOUT values

[Martin K. Petersen (Oracle)]

On Thu, 22 Oct 2026 02:55:11 +0000, Wang Yingjie wrote:

> SG_SET_TIMEOUT accepts a signed int in USER_HZ units. The sg character
> device rejects negative values and limits positive values so the converted
> timeout fits its destination field. The block SCSI and BSG paths instead
> pass the value to clock_t_to_jiffies(), which accepts an unsigned long,
> and store the result in an unsigned int.
> 
> Negative values are converted into large unsigned timeouts. On 64-bit
> systems, large positive values can also exceed UINT_MAX after conversion
> and are truncated on assignment. With HZ=1000 and USER_HZ=100, for
> example, 429496730 clock ticks become 4294967300 jiffies and are stored
> as 4 jiffies. On 32-bit systems, an overflowing conversion becomes
> ULONG_MAX, which is an unsafe relative interval for the block timer
> comparisons.
> 
> [...]

Applied to 7.4/scsi-queue, thanks!

[1/1] scsi: handle out-of-range SG_SET_TIMEOUT values
      https://git.kernel.org/mkp/scsi/c/9a6cb1da4f3b

-- 
Martin K. Petersen