[PATCH] scsi: reject negative SG_SET_TIMEOUT values

[Wang Yingjie]

From: Yingjie Wang <x-professor@xxxxxxxxxxx>

SG_SET_TIMEOUT reads its argument as a signed int in USER_HZ units. The
sg character device rejects negative values, while the block SCSI ioctl
and BSG paths pass them to clock_t_to_jiffies(), which takes an unsigned
long.

On a 64-bit system with HZ=1000, passing -5 first converts it to a large
unsigned value, causing clock_t_to_jiffies() to return ULONG_MAX.
Storing that result in sdev->sg_timeout or bd->timeout truncates it to
UINT_MAX. SG_GET_TIMEOUT then reports 429496729 ticks, and an SG_IO
request with a zero per-request timeout inherits a timeout of about
49.7 days.

Reject negative values in both paths with -EIO, matching the
longstanding behavior of the sg character device.

The block SCSI path predates Git history. The BSG path has exposed the
same behavior since BSG was introduced.

Fixes: 3d6392cfbd7d ("bsg: support for full generic block layer SG v3")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yingjie Wang <x-professor@xxxxxxxxxxx>
---
 block/bsg.c               | 2 ++
 drivers/scsi/scsi_ioctl.c | 9 ++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/block/bsg.c b/block/bsg.c
index 82aaf3cee582..681da79a5ba2 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -132,6 +132,8 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case SG_SET_TIMEOUT:
 		if (get_user(val, intp))
 			return -EFAULT;
+		if (val < 0)
+			return -EIO;
 		bd->timeout = clock_t_to_jiffies(val);
 		return 0;
 	case SG_GET_TIMEOUT:
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index c14f81403a09..162a21112d49 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -195,10 +195,13 @@ static int sg_set_timeout(struct scsi_device *sdev, int __user *p)
 {
 	int timeout, err = get_user(timeout, p);
 
-	if (!err)
-		sdev->sg_timeout = clock_t_to_jiffies(timeout);
+	if (err)
+		return err;
+	if (timeout < 0)
+		return -EIO;
 
-	return err;
+	sdev->sg_timeout = clock_t_to_jiffies(timeout);
+	return 0;
 }
 
 static int sg_get_reserved_size(struct scsi_device *sdev, int __user *p)

base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
-- 
2.43.0