search

KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

UBSAN: signed-integer-overflow in ../drivers/scsi/sr_ioctl.c:436:9 #357

Closed JustinStitt closed 1 month ago

JustinStitt commented 2 months ago 
[   65.194362] ------------[ cut here ]------------
[   65.197752] UBSAN: signed-integer-overflow in ../drivers/scsi/sr_ioctl.c:436:9
[   65.203607] -2147483648 * 177 cannot be represented in type 'int'
[   65.207911] CPU: 2 PID: 10416 Comm: syz-executor.1 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1
[   65.213585] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   65.219923] Call Trace:
[   65.221556]  <TASK>
[   65.223029]  dump_stack_lvl+0x93/0xd0
[   65.225573]  handle_overflow+0x171/0x1b0
[   65.228219]  sr_select_speed+0xeb/0xf0
[   65.230786]  ? __pm_runtime_resume+0xe6/0x130
[   65.233606]  sr_block_ioctl+0x15d/0x1d0
[   65.236132]  ? __pfx_sr_block_ioctl+0x10/0x10
[   65.238996]  blkdev_ioctl+0x419/0x500
[   65.241425]  ? __pfx_blkdev_ioctl+0x10/0x10
[   65.244138]  __se_sys_ioctl+0xdd/0x140
[   65.246642]  do_syscall_64+0xd4/0x1b0
[   65.249074]  ? arch_exit_to_user_mode_prepare+0x11/0x60
[   65.252543]  entry_SYSCALL_64_after_hwframe+0x6f/0x77
[   65.255835] RIP: 0033:0x7f10c8c05539
[   65.258150] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   65.269913] RSP: 002b:00007f10c7f9d0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   65.274946] RAX: ffffffffffffffda RBX: 00007f10c8d39f80 RCX: 00007f10c8c05539
[   65.279588] RDX: 0000000080000000 RSI: 0000000000005322 RDI: 0000000000000003
[   65.284284] RBP: 00007f10c8c64496 R08: 0000000000000000 R09: 0000000000000000
[   65.288890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   65.293363] R13: 0000000000000002 R14: 00007f10c8d39f80 R15: 00007fff09e25858
[   65.297865]  </TASK>
[   65.299529] ---[ end trace ]---
JustinStitt commented 2 months ago

patch: https://lore.kernel.org/r/20240508-b4-b4-sio-sr_select_speed-v1-1-968906b908b7@google.com

v2: https://lore.kernel.org/r/20240508-b4-b4-sio-sr_select_speed-v2-1-00b68f724290@google.com

JustinStitt commented 1 month ago

patch applied to a tree: https://lore.kernel.org/all/yq1msorrx04.fsf@ca-mkp.ca.oracle.com/